Security News > 2021 > December > Critical Apache HTTPD Server Bugs Could Lead to RCE, DoS
Don't duck at the latest mention of Apache: Two critical bugs in its HTTP web server - HTTPD - need to be patched pronto, lest they lead to attackers triggering denial of service or bypassing your security policies.
Both vulnerabilities are found in Apache HTTP Server 2.4.51 and earlier.
CVE-2021-44790: Possible buffer overflow when parsing a carefully crafted request in the mod lua multipart parser of Apache HTTP Server 2.4.51 and earlier.
CVE-2021-44224: Possible NULL dereference or Server Side Request Forgery in forward proxy configurations, likewise in Apache HTTP Server 2.4.51 and earlier.
These bugs shouldn't get lost amidst the Log4J brouhaha, Ducklin said, given that "You almost certainly have Apache HTTPD in your network somewhere. Just like Log4j, HTTPD has a habit of getting itself quietly included into software projects, for example as part of an internal service that works so well that it rarely draws attention to itself, or as a component built unobtrusively into a product or service you sell that isn't predominantly thought of as 'containing a web server.'".
"Our cyber-debt specific to Apache software was substantial prior to Log4Shell or these new HTTPD web server vulns."
News URL
https://threatpost.com/apache-httpd-server-bugs-rce-dos/177234/
Related news
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- SAP fixes critical vulnerabilities in NetWeaver application servers (source)
- Critical SimpleHelp vulnerabilities fixed, update your server instances! (source)
- Critical Flaws in WGS-804HPT Switches Enable RCE and Network Exploitation (source)
- Unpatched PHP Voyager Flaws Leave Servers Open to One-Click RCE Exploits (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- New OpenSSH flaws expose SSH servers to MiTM and DoS attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-12-20 | CVE-2021-44790 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). | 9.8 |
| 2021-12-20 | CVE-2021-44224 | NULL Pointer Dereference vulnerability in multiple products A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). | 8.2 |