PT-2012-3111 · Apache · Mod Fcgid+1

Daniel Kahn Gillmor · Published 2012-03-19 · Updated 2017-08-29 · CVE-2012-1181

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions mod fcgid module version 2.3.6 for the Apache HTTP Server

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending a series of HTTP requests. This is due to the mod fcgid module not recognizing the FcgidMaxProcessesPerClass directive for a virtual host, leading to a process count higher than the intended limit.

Recommendations For mod fcgid module version 2.3.6, consider disabling the module or restricting its use until a patch is available to prevent remote attackers from causing a denial of service.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-1181

DSA-2436-1

Affected Products

Apache Http Server

Mod Fcgid

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2012-1181 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1181 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1181 · Vendor Advisory
• http://debian.org/security/2012/dsa-2436 · Vendor Advisory
• https://issues.apache.org/bugzilla/show_bug.cgi?id=49902 · Patch
• https://security-tracker.debian.org/tracker/CVE-2012-1181 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/03/16/2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1181 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74181 · Note
• http://securityfocus.com/bid/52565 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814 · Note
• http://openwall.com/lists/oss-security/2012/03/15/10 · Note