CVE-2013-6438

Опубликовано: 18 мар. 2014

Источник: nvd

CVSS2: 5

EPSS Средний

Описание

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Ссылки

http://advisories.mageia.org/MGASA-2014-0135.html
Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Broken Link
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Broken Link
Mailing List
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=141390017113542&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23
Mailing List
Third Party Advisory
http://secunia.com/advisories/58230
Not Applicable
http://secunia.com/advisories/59315
Not Applicable
http://secunia.com/advisories/59345
Not Applicable
http://secunia.com/advisories/60536
Not Applicable
http://security.gentoo.org/glsa/glsa-201408-12.xml
Third Party Advisory
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c?r1=1528718&r2=1556428&diff_format=h
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21669554
Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676091
Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676092
Third Party Advisory
http://www.apache.org/dist/httpd/CHANGES_2.4.9
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.2.27 (исключая)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.4.1 (включая) до 2.4.9 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.1.3.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.29578

Средний

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2013-6438

ubuntu

больше 11 лет назад

CVE-2013-6438

redhat

почти 12 лет назад

CVE-2013-6438

debian

больше 11 лет назад

The dav_xml_get_cdata function in main/util.c in the mod_dav module in ...

GHSA-2xpp-q4gq-7cc3

github

больше 3 лет назад

ELSA-2014-0370

oracle-oval

больше 11 лет назад

ELSA-2014-0370: httpd security update (MODERATE)

EPSS

Процентиль: 96%

0.29578

Средний

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo