PT-2014-3476 · Apache+5 · Apache Http Server+5

Published 2014-03-17 · Updated 2024-06-15 · CVE-2014-0098

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.8

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and daemon crash. This is achieved through a crafted cookie that is not properly handled during truncation, specifically targeting the log cookie function in the mod log config module.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod log config module until a patch is applied.

Fix

Related Identifiers

ALT-PU-2015-1890

CESA-2014_0370

CVE-2014-0098

HPSBUX03102

HPSBUX03150

MGASA-2014-0135

OPENSUSE-SU-2014_0969-1

OPENSUSE-SU-2024:10268-1

RHSA-2014:0369

RHSA-2014:0370

RHSA-2014:0783

RHSA-2014:0826

RHSA-2014_0369

RHSA-2014_0370

SUSE-SU-2015:0689-1

Affected Products

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 212

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Security Note
• http://marc.info/?l=bugtraq&m=141390017113542&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00398 · Security Note
• https://bdu.fstec.ru/vul/2015-00376 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0118 · Security Note
• https://bdu.fstec.ru/vul/2015-01282 · Security Note
• http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3478 · Security Note
• http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0370.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3981 · Security Note
• http://security.gentoo.org/glsa/glsa-201408-12.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0098 · Security Note