|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
 |
Vulnerability Note VU#206537
Apache vulnerable to DoS
OverviewA remotely exploitable denial-of-service vulnerability exists in the Apache HTTP Server. Exploitation of this vulnerability may allow an attacker to consume all available system resources, resulting in a denial-of-service condition.
I. DescriptionThe Apache HTTP Server is a very popular freely available web server that runs on a variety of operating systems, including UNIX, Linux, and Microsoft Windows (Win32).
A vulnerability exists in the way the Apache HTTP Server handles excessively large chunks of consecutive linefeed characters. Apache 2.0.44 (both the Windows & UNIX implementations) contains this vulnerability. Prior 2.x versions of Apache may contain the vulnerability. For more information, please see the iDEFENSE Advisory.
II. ImpactExploitation of this vulnerability may allow an attacker to consume all available system resources, resulting in a denial-of-service condition.
III. SolutionApply a patch from your vendor. If a patch is not available, you may wish to upgrade to Apache HTTP Server 2.0.45. The Apache Software Foundation has provided a patch as well.
Systems Affected
References
http://www.idg.com.sg/idgwww.nsf/unidlookup/315B17C00BE0ADBD48256CFE0013EEFB?OpenDocument
http://news.zdnet.co.uk/story/0,,t269-s2132975,00.html?rtag=zdnetukhompage
http://marc.theaimsgroup.com/?l=bugtraq&m=104931360606484&w=2
http://www.businessweek.com/technology/cnet/stories/995309.htm
http://www.neowin.net/comments.php?id=10012&category=main
http://www.pcworld.com/news/article/0,aid,110142,00.asp
http://www.nwfusion.com/news/2003/0403newapach.html
http://www.theregister.co.uk/content/55/30126.html
http://www.idefense.com/advisory/04.08.03.txt
http://www.vnunet.com/News/1139961
http://httpd.apache.org/download.cgi
Credit
This vulnerability was discovered by iDEFENSE Inc. The CERT/CC thanks iDEFENSE Inc. for the information contained in their document, upon which this document is based.
This document was written by Ian A Finlay.
Other Information
| Date Public: | 2003-04-08 |
| Date First Published: | 2003-04-08 |
| Date Last Updated: | 2003-09-18 |
| CERT Advisory: | |
| CVE-ID(s): | CAN-2003-0132 |
| NVD-ID(s): | CAN-2003-0132 |
| US-CERT Technical Alerts: | |
| Metric: | 9.72 |
| Document Revision: | 17 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|