PT-2011-5194 · Apache+2 · Apache Http Server+2

Halfdog · Published 2011-11-28 · Updated 2024-06-15 · CVE-2012-0021

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.17 through 2.2.21

Description The issue is related to the mod log config module, specifically the log cookie function in mod log config.c. When a threaded MPM is used, it does not properly handle a %{cookiename}C format string. This allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value, or by sending a specific cookie.

Recommendations For Apache HTTP Server versions 2.2.17 through 2.2.21, consider disabling the mod log config module or avoiding the use of the '%{cookiename}C' log format string until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-0021

HPSBUX02761

OPENSUSE-SU-2024:10268-1

RHSA-2012:0542

SUSE-SU-2013_0389-1

SUSE-SU-2013_0469-1

SUSE-SU-2013_0830-1

SUSE-SU-2017:2907-1

Affected Products

Apache Http Server

Hp-Ux

Suse

References · 164

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0542.html · Vendor Advisory
• https://issues.apache.org/bugzilla/show_bug.cgi?id=52256 · Patch
• http://marc.info/?l=bugtraq&m=133494237717847&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0021 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-0021 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0021 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0021 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4557 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053 · Security Note
• https://osv.dev/vulnerability/CVE-2012-0021 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2687 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:012 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0543.html · Vendor Advisory