PT-2011-4948 · Apache · Apache Http Server

Published 2011-11-08 · Updated 2012-07-03 · CVE-2011-4415

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.0.x through 2.0.64 Apache HTTP Server versions 2.2.x through 2.2.21

Description The issue is related to the ap pregsub function in server/util.c, which does not restrict the size of values of environment variables when the mod setenvif module is enabled. This allows local users to cause a denial of service, either through memory consumption or a NULL pointer dereference, by creating a .htaccess file with a crafted SetEnvIf directive and sending a crafted HTTP request header. The problem is associated with the "len +=" statement and the apr pcalloc function call.

Recommendations For Apache HTTP Server versions 2.0.x through 2.0.64, consider disabling the mod setenvif module until a patch is available. For Apache HTTP Server versions 2.2.x through 2.2.21, consider disabling the mod setenvif module until a patch is available. As a temporary workaround, restrict access to the .htaccess file to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4415

Affected Products

Apache Http Server

References · 10

• 🔥 http://halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html · Exploit
• 🔥 http://halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow · Exploit
• 🔥 https://exploit-db.com/exploits/41769 · Exploit
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4415 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4415 · Security Note
• http://gossamer-threads.com/lists/apache/dev/403775 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4415 · Note