PT-2014-1435 · Apache · Apache Http Server

Published 2014-07-15 · Updated 2024-06-15 · CVE-2014-3523

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.1 through 2.4.9

Description A memory leak in the winnt accept function in the WinNT MPM allows remote attackers to cause a denial of service via crafted requests, leading to memory consumption. This issue is related to the default AcceptFilter being enabled on Windows. A remote attacker could send carefully crafted requests that would leak memory and eventually lead to a denial of service against the server.

Recommendations For versions 2.4.1 through 2.4.9, update to version 2.4.10 or later to resolve the issue. As a temporary workaround, consider disabling the default AcceptFilter to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-00397

CVE-2014-3523

OPENSUSE-SU-2024:10268-1

Affected Products

Apache Http Server

References · 75

• http://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2957.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00397 · Security Note
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3523 · Security Note
• http://marc.info/?l=bugtraq&m=143748090628601&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3523 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2010-2068 · Note
• https://suse.com/security/cve/CVE-2010-1623 · Note
• https://suse.com/security/cve/CVE-2011-3368 · Note
• https://suse.com/security/cve/CVE-2009-1891 · Note
• https://suse.com/security/cve/CVE-2009-3560 · Note
• https://suse.com/security/cve/CVE-2011-4317 · Note
• https://suse.com/security/cve/CVE-2010-0434 · Note