PT-2012-2254 · Apache+4 · Apache Http Server+4

Halfdog · Published 2012-01-11 · Updated 2024-06-15 · CVE-2012-0031

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.21 and earlier

Description The issue allows local users to cause a denial of service, potentially leading to a daemon crash during shutdown, by modifying a certain type field within a scoreboard shared memory segment. This modification results in an invalid call to the free function. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

Recommendations For Apache HTTP Server versions 2.2.21 and earlier, update to a version later than 2.2.21 to resolve the issue. As a temporary workaround, consider restricting access to the scoreboard shared memory segment to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CESA-2012_0128

CVE-2012-0031

DSA-2405-1

HPSBUX02761

OPENSUSE-SU-2024:10268-1

RHSA-2012:0128

RHSA-2012:0323

RHSA-2012:0542

RHSA-2012_0128

RHSA-2012_0323

Affected Products

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 142

• 🔥 http://halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown · Exploit
• 🔥 https://exploit-db.com/exploits/41768 · Exploit
• https://osv.dev/vulnerability/CVE-2012-0031 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3639 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0543.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0031 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0031 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0542.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory
• http://secunia.com/advisories/47410 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133494237717847&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3607 · Security Note
• http://debian.org/security/2012/dsa-2405 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4317 · Security Note