PT-2011-4546 · Apache+4 · Apache Http Server+4

Halfdog · Published 2011-11-02 · Updated 2024-06-15 · CVE-2011-3607

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.0.x through 2.0.64 Apache HTTP Server versions 2.2.x through 2.2.21

Description The issue is related to an integer overflow in the ap pregsub function, which can be exploited when the mod setenvif module is enabled. This allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

Recommendations For Apache HTTP Server versions 2.0.x through 2.0.64, update to a version where this issue is fixed. For Apache HTTP Server versions 2.2.x through 2.2.21, update to a version where this issue is fixed. As a temporary workaround, consider disabling the mod setenvif module until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CESA-2012_0128

CVE-2011-3607

DSA-2405-1

HPSBUX02761

OPENSUSE-SU-2024:10268-1

RHSA-2012:0128

RHSA-2012:0323

RHSA-2012:0542

RHSA-2012_0128

RHSA-2012_0323

Affected Products

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 150

• 🔥 https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422 · Exploit
• 🔥 http://halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow · Exploit
• 🔥 http://halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html · Exploit
• 🔥 https://exploit-db.com/exploits/41769 · Exploit
• http://rhn.redhat.com/errata/RHSA-2012-0542.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133494237717847&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3607 · Vendor Advisory
• http://secunia.com/advisories/45793 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3607 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0021 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053 · Security Note
• http://marc.info/?l=bugtraq&m=134987041210674&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3639 · Security Note