PT-2014-3115 · Apache+5 · Apache Http Server+5

Amin Tora + 1 · Published 2014-03-17 · Updated 2024-06-15 · CVE-2013-6438

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.8

Description The issue arises from the dav xml get cdata function in the mod dav module, which fails to properly remove whitespace characters from CDATA sections. This allows remote attackers to cause a denial of service (daemon crash) by sending a crafted DAV WRITE request.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod dav module until a patch is applied.

Fix

Related Identifiers

ALT-PU-2015-1890

CESA-2014_0370

CVE-2013-6438

DLA-66-1

HPSBUX03102

HPSBUX03150

MGASA-2014-0135

OPENSUSE-SU-2014_0969-1

OPENSUSE-SU-2024:10268-1

RHSA-2014:0369

RHSA-2014:0370

RHSA-2014:0783

RHSA-2014:0826

RHSA-2014_0369

RHSA-2014_0370

SUSE-SU-2014_0967-1

SUSE-SU-2014_1080-1

SUSE-SU-2014_1081-1

SUSE-SU-2015:0689-1

Affected Products

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 214

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Security Note
• http://marc.info/?l=bugtraq&m=141390017113542&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00398 · Security Note
• https://bdu.fstec.ru/vul/2015-00376 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0118 · Security Note
• https://bdu.fstec.ru/vul/2015-01282 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3478 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6438 · Security Note
• http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0370.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119 · Security Note
• http://apache.org/dist/httpd/CHANGES_2.4.9 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3981 · Security Note
• http://security.gentoo.org/glsa/glsa-201408-12.xml · Vendor Advisory