bugtraq - PATCH: [CAN-2003-0132] Apache 2.0.44 Denial of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5.2.0.9.2.20030411142144.026b7ab8__24400.2284402542$1050133698@pop3.rowe-clan.net>
Date: Fri, 11 Apr 2003 16:32:34 -0500
From: "William A. Rowe, Jr." <wrowe@...e-clan.net>
To: Bugtraq <bugtraq@...urityfocus.com>
Subject: PATCH: [CAN-2003-0132] Apache 2.0.44 Denial of Service
  Vulnerability

In additional response to the iDEFENSE Security Advisory 04.08.03 cited 
below, the Apache HTTP Server Project has published a specific patch 
to address this Denial of Service vulnerability for the 2.0.44 server version.

The patch may or may not apply to earlier versions of Apache 2.0, and 
if applied to earlier versions, may or may not fully address the vulnerability. 
Review was limited to correcting the but in the 2.0.44 release only.

The patch can be obtained from;

http://www.apache.org/dist/httpd/patches/apply_to_2.0.44/denial_of_service_fix.patch

The Apache HTTP Server project continues to caution users to obtain the
latest release (2.0.45 at this time) from

http://httpd.apache.org/download.cgi

to improve stability and obtain the most current bug fixes.  As noted in the
prior announcement;

OS/2 Users of both 2.0.44 and 2.0.45 have an additional Denial of Service 
vulnerability identified and reported by Robert Howard <rihoward@...bw.com>
that be addressed with the next release.  Until that time, OS2 users must obtain 
an additional patch before building Apache release 2.0.45 or prior:

http://www.apache.org/dist/httpd/patches/apply_to_2.0.45/os2_filestat_security_fix.patch

That is all.

At 11:44 AM 4/8/2003, iDEFENSE Labs wrote:
>iDEFENSE Security Advisory 04.08.03:
>http://www.idefense.com/advisory/04.08.03.txt
>Denial of Service in Apache HTTP Server 2.x
>April 8, 2003
>
>Remote exploitation of a memory leak in the Apache HTTP Server causes the
>daemon to over utilize system resources on an affected system. The problem
>is HTTP Server's handling of large chunks of consecutive linefeed
>characters. The web server allocates an eighty-byte buffer for each
>linefeed character without specifying an upper limit for allocation.
>Consequently, an attacker can remotely exhaust system resources by
>generating many requests containing these characters.
>[...]
>
>V. VENDOR FIX/RESPONSE
>
>Apache HTTP Server 2.0.45, which fixes this vulnerability, can be
>downloaded at http://httpd.apache.org/download.cgi . This release
>introduces a limit of 100 blank lines accepted before an HTTP connection
>is discarded.