PT-2012-5479 · Apache+4 · Apache Http Server+4

Niels Heinen · Published 2012-01-04 · Updated 2021-06-06 · CVE-2012-4557

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.12 through 2.2.21

Description The issue allows remote attackers to cause a denial of service by placing a worker node into an error state upon detection of a long request-processing time. This can be achieved via an expensive request. A flaw was found when the mod proxy ajp module connects to a backend server that takes too long to respond, potentially leading to a temporary denial of service.

Recommendations For Apache HTTP Server versions 2.2.12 through 2.2.21, consider disabling the mod proxy ajp module as a temporary workaround until a patch is available. Restrict access to the backend server to minimize the risk of exploitation. Avoid sending expensive requests to the affected server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CESA-2013_0512

CVE-2012-4557

DSA-2579-1

HPSBUX02866

RHSA-2011:0897

RHSA-2013:0512

RHSA-2013_0512

Affected Products

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 80

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• 🔥 http://svn.apache.org/viewvc?view=revision&revision=1227298 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4431 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-4557 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4929 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0512.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4534 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4557 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5885 · Security Note
• http://httpd.apache.org/security/vulnerabilities_22.html#2.2.22 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2733 · Security Note
• http://debian.org/security/2012/dsa-2579 · Vendor Advisory