Apache: Denial of Service — GLSA 200807-06

Multiple vulnerabilities in Apache might lead to a Denial of Service.

Affected Packages

www-servers/apache on all architectures
Affected versions < 2.2.9
Unaffected versions >= 2.2.9

Background

The Apache HTTP server is one of the most popular web servers on the Internet.

Description

Multiple vulnerabilities have been discovered in Apache:

  • Dustin Kirkland reported that the mod_ssl module can leak memory when the client reports support for a compression algorithm (CVE-2008-1678).
  • Ryujiro Shibuya reported that the ap_proxy_http_process_response() function in the mod_proxy module does not limit the number of forwarded interim responses (CVE-2008-2364).
  • sp3x of SecurityReason reported a Cross-Site Request Forgery vulnerability in the balancer-manager in the mod_proxy_balancer module (CVE-2007-6420).

Impact

A remote attacker could exploit these vulnerabilities by connecting to an Apache httpd, by causing an Apache proxy server to connect to a malicious server, or by enticing a balancer administrator to connect to a specially-crafted URL, resulting in a Denial of Service of the Apache daemon.

Workaround

There is no known workaround at this time.

Resolution

All Apache users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.9"

References

Release Date
July 09, 2008

Latest Revision
July 09, 2008: 01

Severity
normal

Exploitable
remote

Bugzilla entries