CVE-2014-0098

Опубликовано: 18 мар. 2014

Источник: nvd

CVSS2: 5

EPSS Средний

Описание

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Ссылки

http://advisories.mageia.org/MGASA-2014-0135.html
Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Broken Link
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Broken Link
Mailing List
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=141390017113542&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23
Mailing List
Third Party Advisory
http://secunia.com/advisories/58230
Not Applicable
http://secunia.com/advisories/58915
Not Applicable
http://secunia.com/advisories/59219
Not Applicable
http://secunia.com/advisories/59315
Not Applicable
http://secunia.com/advisories/59345
Not Applicable
http://secunia.com/advisories/60536
Not Applicable
http://security.gentoo.org/glsa/glsa-201408-12.xml
Third Party Advisory
http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15320.html
Third Party Advisory
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c
Vendor Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21668973
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.2.27 (исключая)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.4.1 (включая) до 2.4.9 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:4.63:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:4.71:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:5.1:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.42346

Средний

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2014-0098

ubuntu

больше 11 лет назад

CVE-2014-0098

redhat

больше 11 лет назад

CVE-2014-0098

debian

больше 11 лет назад

The log_cookie function in mod_log_config.c in the mod_log_config modu ...

GHSA-mfxf-5vhj-623g

github

больше 3 лет назад

ELSA-2014-0370

oracle-oval

больше 11 лет назад

ELSA-2014-0370: httpd security update (MODERATE)

EPSS

Процентиль: 97%

0.42346

Средний

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo