CVE-2009-1890

Опубликовано: 05 июл. 2009

Источник: nvd

CVSS2: 7.1

EPSS Средний

Описание

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Ссылки

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
Broken Link
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=129190899612998&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=129190899612998&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://osvdb.org/55553
Broken Link
http://secunia.com/advisories/35691
Not Applicable
Vendor Advisory
http://secunia.com/advisories/35721
Not Applicable
http://secunia.com/advisories/35793
Not Applicable
http://secunia.com/advisories/35865
Not Applicable
http://secunia.com/advisories/37152
Not Applicable
Vendor Advisory
http://secunia.com/advisories/37221
Not Applicable
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200907-04.xml
Third Party Advisory
http://support.apple.com/kb/HT3937
Broken Link
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587
Patch
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587
Patch
Vendor Advisory
http://svn.apache.org/viewvc?view=rev&revision=790587
Vendor Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0142
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg1PK91259
Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.2.12 (исключая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.2152

Средний

7.1 High

CVSS2

Дефекты

CWE-400

Связанные уязвимости

CVE-2009-1890

ubuntu

почти 16 лет назад

CVE-2009-1890

redhat

почти 16 лет назад

CVE-2009-1890

msrc

около 3 лет назад

Описание отсутствует

CVE-2009-1890

debian

почти 16 лет назад

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy mo ...

GHSA-wvqw-w5hq-v4m4

github

около 3 лет назад

EPSS

Процентиль: 95%

0.2152

Средний

7.1 High

CVSS2

Дефекты

CWE-400