Vulnerabilities > CVE-2011-3192 - Resource Exhaustion vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- XML Ping of the Death An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
- XML Entity Expansion An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
- Inducing Account Lockout An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
- Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS)) XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.
Exploit-Db
description Apache httpd Remote Denial of Service (memory exhaustion). CVE-2011-3192,CVE-2014-5329. Dos exploits for multiple platform file exploits/multiple/dos/17696.pl id EDB-ID:17696 last seen 2016-02-02 modified 2011-08-19 platform multiple port published 2011-08-19 reporter kingcope source https://www.exploit-db.com/download/17696/ title Apache httpd Remote Denial of Service memory exhaustion type dos description Apache HTTP Server Denial of Service. CVE-2011-3192,CVE-2014-5329. Dos exploit for linux platform id EDB-ID:18221 last seen 2016-02-02 modified 2011-12-09 published 2011-12-09 reporter Ramon de C Valle source https://www.exploit-db.com/download/18221/ title Apache HTTP Server Denial of Service
Metasploit
| description | The byterange filter in the Apache HTTP Server 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, exploit called "Apache Killer" |
| id | MSF:AUXILIARY/DOS/HTTP/APACHE_RANGE_DOS |
| last seen | 2020-06-14 |
| modified | 2020-05-12 |
| published | 2011-09-23 |
| references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/dos/http/apache_range_dos.rb |
| title | Apache Range Header DoS (Apache Killer) |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2011-1294.NASL description Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 Long Life, 5.6 Extended Update Support, and 6.0 Extended Update Support. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 63998 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63998 title RHEL 5 / 6 : httpd (RHSA-2011:1294) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2011:1294. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(63998); script_version("1.16"); script_cvs_date("Date: 2019/10/25 13:36:16"); script_cve_id("CVE-2011-3192"); script_bugtraq_id(49303); script_xref(name:"RHSA", value:"2011:1294"); script_name(english:"RHEL 5 / 6 : httpd (RHSA-2011:1294)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 Long Life, 5.6 Extended Update Support, and 6.0 Extended Update Support. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect." ); script_set_attribute( attribute:"see_also", value:"https://www.redhat.com/security/data/cve/CVE-2011-3192.html" ); script_set_attribute( attribute:"see_also", value:"http://rhn.redhat.com/errata/RHSA-2011-1294.html" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:httpd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:httpd-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:httpd-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:httpd-manual"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:httpd-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mod_ssl"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.6"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.0"); script_set_attribute(attribute:"patch_publication_date", value:"2011/09/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2019 Tenable Network Security, Inc."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); flag = 0; if (rpm_check(release:"RHEL5", sp:"3", cpu:"i386", reference:"httpd-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"x86_64", reference:"httpd-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"i386", reference:"httpd-devel-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"x86_64", reference:"httpd-devel-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"i386", reference:"httpd-manual-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"x86_64", reference:"httpd-manual-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"i386", reference:"mod_ssl-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"3", cpu:"x86_64", reference:"mod_ssl-2.2.3-22.el5_3.3")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"i386", reference:"httpd-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"s390x", reference:"httpd-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"x86_64", reference:"httpd-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", reference:"httpd-devel-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"i386", reference:"httpd-manual-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"s390x", reference:"httpd-manual-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"x86_64", reference:"httpd-manual-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"i386", reference:"mod_ssl-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"s390x", reference:"mod_ssl-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL5", sp:"6", cpu:"x86_64", reference:"mod_ssl-2.2.3-45.el5_6.2")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"httpd-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"httpd-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"httpd-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", reference:"httpd-debuginfo-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", reference:"httpd-devel-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", reference:"httpd-manual-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"httpd-tools-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"httpd-tools-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"httpd-tools-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"i686", reference:"mod_ssl-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"mod_ssl-2.2.15-5.el6_0.1")) flag++; if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"mod_ssl-2.2.15-5.el6_0.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2011-1392.NASL description Updated httpd packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) Red Hat would like to thank Context Information Security for reporting this issue. This update also fixes the following bug : * The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions. (BZ#736593, BZ#736594) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 56579 published 2011-10-21 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56579 title RHEL 4 / 5 : httpd (RHSA-2011:1392) NASL family Web Servers NASL id WEBSPHERE_8_0_0_1.NASL description IBM WebSphere Application Server 8.0 before Fix Pack 1 appears to be running on the remote host and is potentially affected by the following vulnerabilities : - An open redirect vulnerability exists related to the last seen 2020-06-01 modified 2020-06-02 plugin id 56348 published 2011-09-30 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56348 title IBM WebSphere Application Server 8.0 < Fix Pack 1 Multiple Vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2011-168.NASL description A vulnerability has been discovered and corrected in apache : The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary error state in the backend server) via a malformed HTTP request (CVE-2011-3348). The fix for CVE-2011-3192 provided by the MDVSA-2011:130 advisory introduced regressions in the way httpd handled certain Range HTTP header values. The updated packages have been patched to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 56764 published 2011-11-10 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56764 title Mandriva Linux Security Advisory : apache (MDVSA-2011:168) NASL family Scientific Linux Local Security Checks NASL id SL_20111020_HTTPD_ON_SL6_X.NASL description The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) It was discovered that mod_proxy_ajp incorrectly returned an last seen 2020-06-01 modified 2020-06-02 plugin id 61161 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61161 title Scientific Linux Security Update : httpd on SL6.x i386/x86_64 NASL family Web Servers NASL id APACHE_RANGE_DOS.NASL description The version of Apache HTTP Server running on the remote host is affected by a denial of service vulnerability. Making a series of HTTP requests with overlapping ranges in the Range or Request-Range request headers can result in memory and CPU exhaustion. A remote, unauthenticated attacker could exploit this to make the system unresponsive. Exploit code is publicly available and attacks have reportedly been observed in the wild. last seen 2020-06-01 modified 2020-06-02 plugin id 55976 published 2011-08-25 reporter This script is Copyright (C) 2011-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/55976 title Apache HTTP Server Byte Range DoS NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201206-25.NASL description The remote host is affected by the vulnerability described in GLSA-201206-25 (Apache HTTP Server: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Apache HTTP Server. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might obtain sensitive information, gain privileges, send requests to unintended servers behind proxies, bypass certain security restrictions, obtain the values of HTTPOnly cookies, or cause a Denial of Service in various ways. A local attacker could gain escalated privileges. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 59678 published 2012-06-25 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59678 title GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_10_7_2.NASL description The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.2. This version contains numerous security-related fixes for the following components : - Apache - Application Firewall - ATS - BIND - Certificate Trust Policy - CFNetwork - CoreMedia - CoreProcesses - CoreStorage - File Systems - iChat Server - Kernel - libsecurity - Open Directory - PHP - python - QuickTime - SMB File Server - X11 last seen 2020-06-01 modified 2020-06-02 plugin id 56480 published 2011-10-13 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56480 title Mac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities NASL family Web Servers NASL id HPSMH_7_0_0_24.NASL description According to the web server last seen 2020-06-01 modified 2020-06-02 plugin id 58811 published 2012-04-20 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/58811 title HP System Management Homepage < 7.0 Multiple Vulnerabilities NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2011-1392.NASL description Updated httpd packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) Red Hat would like to thank Context Information Security for reporting this issue. This update also fixes the following bug : * The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions. (BZ#736593, BZ#736594) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 56570 published 2011-10-21 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56570 title CentOS 4 / 5 : httpd (CESA-2011:1392) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0542.NASL description Updated httpd packages that fix multiple security issues and one bug are now available for JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Apache HTTP Server ( last seen 2020-06-01 modified 2020-06-02 plugin id 78923 published 2014-11-08 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78923 title RHEL 5 / 6 : JBoss Web Server (RHSA-2012:0542) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2011-1391.NASL description Updated httpd packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) It was discovered that mod_proxy_ajp incorrectly returned an last seen 2020-06-01 modified 2020-06-02 plugin id 56578 published 2011-10-21 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56578 title RHEL 6 : httpd (RHSA-2011:1391) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2011-252-01.NASL description Not long ago, httpd package updates were issued to clamp down on a denial of service bug that last seen 2020-06-01 modified 2020-06-02 plugin id 56142 published 2011-09-12 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56142 title Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : httpd (SSA:2011-252-01) NASL family Scientific Linux Local Security Checks NASL id SL_20110831_HTTPD_ON_SL4_X.NASL description The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 61126 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61126 title Scientific Linux Security Update : httpd on SL4.x, SL5.x, SL6.x i386/x86_64 NASL family SuSE Local Security Checks NASL id SUSE_11_4_APACHE2-111026.NASL description This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed: CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method. CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. last seen 2020-06-01 modified 2020-06-02 plugin id 75787 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75787 title openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2011-1391.NASL description From Red Hat Security Advisory 2011:1391 : Updated httpd packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) It was discovered that mod_proxy_ajp incorrectly returned an last seen 2020-06-01 modified 2020-06-02 plugin id 68376 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68376 title Oracle Linux 6 : httpd (ELSA-2011-1391) NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-110831.NASL description This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges. (CVE-2011-3192) It also fixes a issue in mod_dav, where the (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x allowed remote attackers to cause a denial of service (process crash) via a request that lacks a path. (CVE-2010-1452) Also following bugs were fixed : - recommend the default MPM (prefork) via Recommends: in .spec - apache not sending error 304 if mod_deflate is enabled. - take LimitRequestFieldsize config option into account when parsing headers from backend. last seen 2020-06-01 modified 2020-06-02 plugin id 57088 published 2011-12-13 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57088 title SuSE 11.1 Security Update : Apache (SAT Patch Number 5090) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1199-1.NASL description A flaw was discovered in the byterange filter in Apache. A remote attacker could exploit this to cause a denial of service via resource exhaustion. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 56048 published 2011-09-02 reporter Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56048 title Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : apache2 vulnerability (USN-1199-1) NASL family Scientific Linux Local Security Checks NASL id SL_20111020_HTTPD_ON_SL4_X.NASL description The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) This update also fixes the following bug : - The fix for CVE-2011-3192 provided by a previous update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions. All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 61160 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61160 title Scientific Linux Security Update : httpd on SL4.x, SL5.x i386/x86_64 NASL family Fedora Local Security Checks NASL id FEDORA_2011-12667.NASL description This update contains the latest stable release of the Apache HTTP Server. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 56359 published 2011-10-03 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56359 title Fedora 16 : httpd-2.2.21-1.fc16 (2011-12667) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2011-1.NASL description The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 78262 published 2014-10-12 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/78262 title Amazon Linux AMI : httpd (ALAS-2011-1) NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-7722.NASL description This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges. (CVE-2011-3192) It also fixes a bug, where the LimitRequestFieldsize config option into account when parsing headers from backend, thereby avoiding that the receiving buffers are too small. last seen 2020-06-01 modified 2020-06-02 plugin id 57155 published 2011-12-13 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57155 title SuSE 10 Security Update : Apache (ZYPP Patch Number 7722) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2011-1245.NASL description From Red Hat Security Advisory 2011:1245 : Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 68342 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68342 title Oracle Linux 4 / 5 / 6 : httpd (ELSA-2011-1245) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2011-130.NASL description Multiple vulnerabilities has been discovered and corrected in apache : The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086 (CVE-2011-3192). The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 56084 published 2011-09-06 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56084 title Mandriva Linux Security Advisory : apache (MDVSA-2011:130-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2298.NASL description Two issues have been found in the Apache HTTPD web server : - CVE-2011-3192 A vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server. This vulnerability allows an attacker to cause Apache HTTPD to use an excessive amount of memory, causing a denial of service. - CVE-2010-1452 A vulnerability has been found in mod_dav that allows an attacker to cause a daemon crash, causing a denial of service. This issue only affects the Debian 5.0 oldstable/lenny distribution. last seen 2020-03-17 modified 2011-08-30 plugin id 55998 published 2011-08-30 reporter This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/55998 title Debian DSA-2298-2 : apache2 - denial of service NASL family SuSE Local Security Checks NASL id SUSE_11_3_APACHE2-110831.NASL description This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges . (CVE-2011-3192) last seen 2020-06-01 modified 2020-06-02 plugin id 75425 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75425 title openSUSE Security Update : apache2 (openSUSE-SU-2011:0993-1) NASL family F5 Networks Local Security Checks NASL id F5_BIGIP_SOL13114.NASL description The byte-range filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial-of-service (memory and CPU consumption) using a Range header that expresses multiple overlapping ranges. When this vulnerability is exploited, the httpd process consumes all available CPU cycles. As a result of CPU starvation, the Configuration utility, SSH sessions, and other userland processes may appear extremely slow or completely unresponsive. On BIG-IP systems, if the system hardware watchdog timer is not updated for more than 10 seconds, the hardware watchdog restarts the system. (CVE-2011-3192) Impact The performance of userland processes may be severely impaired, and the system may eventually reboot. last seen 2020-06-01 modified 2020-06-02 plugin id 78131 published 2014-10-10 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78131 title F5 Networks BIG-IP : Apache Range header vulnerability (K13114) NASL family Web Servers NASL id APACHE_2_0_65.NASL description According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.65. It is, therefore, affected by several vulnerabilities : - A flaw exists in the byte-range filter, making it vulnerable to denial of service. (CVE-2011-3192) - A flaw exists in last seen 2020-06-01 modified 2020-06-02 plugin id 68914 published 2013-07-16 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68914 title Apache 2.0.x < 2.0.65 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-111026.NASL description This update brings Apache to version 2.2.12. The main reason is the enablement of the Server Name Indication (SNI) that allows several SSL-enabled domains on one IP address (FATE#311973). See the SSLStrictSNIVHostCheck directive as documented in /usr/share/apache2/manual/mod/mod_ssl.html.en Also the patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed were - Denial of service in proxy_ajp when using a undefined method. (CVE-2011-3348) - Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. This update also includes a newer apache2-vhost-ssl.template, which disables SSLv2, and allows SSLv3 and strong ciphers only. Please note that existing vhosts will not be converted. (CVE-2011-3368) last seen 2020-06-01 modified 2020-06-02 plugin id 57089 published 2011-12-13 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57089 title SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5344) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2011-1392.NASL description From Red Hat Security Advisory 2011:1392 : Updated httpd packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368) Red Hat would like to thank Context Information Security for reporting this issue. This update also fixes the following bug : * The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions. (BZ#736593, BZ#736594) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 68377 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68377 title Oracle Linux 4 / 5 : httpd (ELSA-2011-1392) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2011-1245.NASL description Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 56046 published 2011-09-02 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56046 title CentOS 4 : httpd (CESA-2011:1245) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_7F6108D2CEA811E09D580800279895EA.NASL description Apache HTTP server project reports : A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by Apache HTTPD server. last seen 2020-06-01 modified 2020-06-02 plugin id 56017 published 2011-08-31 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56017 title FreeBSD : apache -- Range header DoS vulnerability (7f6108d2-cea8-11e0-9d58-0800279895ea) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2011-01.NASL description The MITRE CVE database describes CVE-2011-3192 as : The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. last seen 2020-06-01 modified 2020-06-02 plugin id 69560 published 2013-09-04 reporter This script is Copyright (C) 2013-2015 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69560 title Amazon Linux AMI : httpd (ALAS-2011-01) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2011-006.NASL description The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied. This update contains numerous security-related fixes for the following components : - Apache - Application Firewall - ATS - BIND - Certificate Trust Policy - CFNetwork - CoreFoundation - CoreMedia - File Systems - IOGraphics - iChat Server - Mailman - MediaKit - PHP - postfix - python - QuickTime - Tomcat - User Documentation - Web Server - X11 last seen 2020-06-01 modified 2020-06-02 plugin id 56481 published 2011-10-13 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56481 title Mac OS X Multiple Vulnerabilities (Security Update 2011-006) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2011-1245.NASL description Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Apache HTTP Server is a popular web server. A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially crafted Range header. (CVE-2011-3192) All httpd users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 56032 published 2011-09-01 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56032 title RHEL 4 / 5 / 6 : httpd (RHSA-2011:1245) NASL family SuSE Local Security Checks NASL id SUSE_11_3_APACHE2-111026.NASL description This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed: CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method. CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. last seen 2020-06-01 modified 2020-06-02 plugin id 75426 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75426 title openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1) NASL family SuSE Local Security Checks NASL id SUSE_APACHE2-7721.NASL description This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges. (CVE-2011-3192) It also fixes some non-security bugs : - take LimitRequestFieldsize config option into account when parsing headers from backend. Thereby avoid that the receiving buffers are too small. bnc#690734. - add / when on a directory to feed correctly linked listings. bnc#661597: * a2enmod shalt not disable a module in query mode. bnc#663359 - New option SSLRenegBufferSize fixes last seen 2020-06-01 modified 2020-06-02 plugin id 56600 published 2011-10-24 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56600 title SuSE 10 Security Update : Apache (ZYPP Patch Number 7721) NASL family Web Servers NASL id WEBSPHERE_6_1_0_41.NASL description IBM WebSphere Application Server 6.1 before Fix Pack 41 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - A cross-site scripting vulnerability via vectors related to web messaging. (CVE-2011-5065) - A cross-site scripting vulnerability in the Installation Verification Test (IVT) in the Install component. (CVE-2011-1362) - The SibRaRecoverableSiXaResource class in the Default Messaging Component does not properly handle a Service Integration Bus (SIB) dump operation involving the Failure Data Capture (FFDC) introspection code. This can allow local users to obtain sensitive information by reading the FFDC log file. (CVE-2011-5066) - A directory traversal vulnerability in the administration console that allows remote attackers to read arbitrary files on the host. (CVE-2011-1359) - A potential Denial of Service with malicious range requests. (CVE-2011-3192) - An unspecified vulnerability in the Web Services Security component when enabling WS-Security for a JAX-WS application. (CVE-2011-1377) last seen 2020-06-01 modified 2020-06-02 plugin id 57607 published 2012-01-19 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57607 title IBM WebSphere Application Server 6.1 < 6.1.0.41 Multiple Vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2011-12715.NASL description This update includes the latest stable release of the Apache HTTP Server, version 2.2.21. Two security issues have been fixed : mod_proxy_ajp when combined with mod_proxy_balancer: Prevents unrecognized HTTP methods from marking ajp: balancer members in an error state, avoiding denial of service. (CVE-2011-3348) Fixes to the handling of byte-range requests to use less memory, to avoid denial of service. (CVE-2011-3192) A number of bugs have been fixed as well. See : http://www.apache.org/dist/httpd/CHANGES_2.2.21 http://www.apache.org/dist/httpd/CHANGES_2.2.20 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 56217 published 2011-09-16 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56217 title Fedora 15 : httpd-2.2.21-1.fc15 (2011-12715) NASL family Misc. NASL id JUNIPER_NSM_JSA10642.NASL description The remote host has one or more instances of NSM (Network and Security Manager) Server running, with version(s) prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities related to its Java and Apache installations. last seen 2020-06-01 modified 2020-06-02 plugin id 77326 published 2014-08-22 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77326 title Juniper NSM < 2012.2R9 Multiple Java and Apache Vulnerabilities (JSA10642) NASL family SuSE Local Security Checks NASL id SUSE_11_4_APACHE2-110831.NASL description This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges . (CVE-2011-3192) last seen 2020-06-01 modified 2020-06-02 plugin id 75786 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75786 title openSUSE Security Update : apache2 (openSUSE-SU-2011:0993-1)
Oval
accepted 2015-04-20T04:00:41.492-04:00 class vulnerability contributors name Yamini Mohan R organization Hewlett-Packard name Sushant Kumar Singh organization Hewlett-Packard name Sushant Kumar Singh organization Hewlett-Packard name Prashant Kumar organization Hewlett-Packard name Mike Cokus organization The MITRE Corporation
description The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. family unix id oval:org.mitre.oval:def:14762 status accepted submitted 2012-01-30T14:02:48.000-05:00 title HP-UX Apache Web Server, Remote Denial of Service (DoS) version 49 accepted 2015-04-20T04:00:42.506-04:00 class vulnerability contributors name Yamini Mohan R organization Hewlett-Packard name Sushant Kumar Singh organization Hewlett-Packard name Prashant Kumar organization Hewlett-Packard name Mike Cokus organization The MITRE Corporation
description The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. family unix id oval:org.mitre.oval:def:14824 status accepted submitted 2012-01-30T13:51:11.000-05:00 title HP-UX Apache Web Server, Remote Denial of Service (DoS) version 48 accepted 2015-05-04T04:00:11.108-04:00 class vulnerability contributors name Sergey Artykhov organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT
definition_extensions comment VisualSVN Server is installed oval oval:org.mitre.oval:def:18636 description The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. family windows id oval:org.mitre.oval:def:18827 status accepted submitted 2013-10-02T13:00:00 title Apache HTTP vulnerability 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 in VisualSVN Server (CVE-2011-3192) version 8
Packetstorm
data source https://packetstormsecurity.com/files/download/122962/obehotel-sqldosinsecure.txt id PACKETSTORM:122962 last seen 2016-12-05 published 2013-08-26 reporter Juan Carlos Garcia source https://packetstormsecurity.com/files/122962/Obehotel-CMS-Denial-Of-Service-SQL-Injection.html title Obehotel CMS Denial Of Service / SQL Injection data source https://packetstormsecurity.com/files/download/123527/opolisdoteu-sqlxssxsrfdos.txt id PACKETSTORM:123527 last seen 2016-12-05 published 2013-10-07 reporter Juan Carlos Garcia source https://packetstormsecurity.com/files/123527/Opolis.eu-Secure-Mail-Blind-SQL-Injection-XSS-CSRF-DoS.html title Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS data source https://packetstormsecurity.com/files/download/126851/protonmail-csrfheader.txt id PACKETSTORM:126851 last seen 2016-12-05 published 2014-05-30 reporter Juan Carlos Garcia source https://packetstormsecurity.com/files/126851/ProtonMail.ch-Header-Injection-CSRF.html title ProtonMail.ch Header Injection / CSRF
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
bulletinFamily exploit description No description provided by source. id SSV:26043 last seen 2017-11-19 modified 2011-12-09 published 2011-12-09 reporter Root source https://www.seebug.org/vuldb/ssvid-26043 title Apache Range Header Denial Of Service bulletinFamily exploit description No description provided by source. id SSV:72403 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-72403 title Apache HTTP Server Denial of Service bulletinFamily exploit description BUGTRAQ ID: 49303 CVE ID: CVE-2011-3192 Apache HTTP Server是Apache软件基金会的一个开放源代码的网页服务器，可以在大多数电脑操作系统中运行，由于其跨平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server在处理Range选项生成回应时存在漏洞，远程攻击者可能利用此漏洞通过发送恶意请求导致服务器失去响应，导致拒绝服务。 此漏洞源于Apache HTTP Server在处理Range头选项中包含的大量重叠范围指定命令时存在的问题，攻击者可通过发送到服务器的特制HTTTP请求耗尽系统资源，导致Apache失去响应，甚至造成操作系统资源耗尽。 Apache 2.x Apache 1.3 临时解决方法： 在厂商提供官方补丁或新版本软件之前，建议用户采用如下的配置方案之一以尽可能免受漏洞的影响： * 使用SetEnvIf配置命令来忽略畸形的Ranger选项，适用于Apache 2.0和2.2 。 修改Apache的配置文件httpd.conf。 去掉如下行的注释： LoadModule headers_module modules/mod_headers.so 增加如下行的配置命令： SetEnvIf Range (,.*?){5,} bad-range=1 RequestHeader unset Range env=bad-range 重启Apache服务器。 * 安装启用mod_rewrite，设置规则过滤规则禁止带有畸形的Ranger选项的请求，适用于所有版本的 Apache 。 修改Apache的配置文件httpd.conf。 去掉如下行的注释： LoadModule rewrite_module modules/mod_rewrite.so 加入如下的mod_rewrite的规则配置行： RewriteEngine on RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) RewriteRule .* - [F] 重启Apache服务器。 上述两种配置会禁止Range选项包含超过5个范围指定命令的请求，在通常应用场景中对Web应用应该不会有什么影响，如果Web应用提供PDF数据或流媒体信息，可能需要调整阈值到更大的数值。 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.apache.org id SSV:20899 last seen 2017-11-19 modified 2011-08-26 published 2011-08-26 reporter Root source https://www.seebug.org/vuldb/ssvid-20899 title Apache HTTP Server畸形Range选项处理远程拒绝服务漏洞
References
- http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD@minotaur.apache.org%3e
- http://www.exploit-db.com/exploits/17696
- http://secunia.com/advisories/45606
- https://bugzilla.redhat.com/show_bug.cgi?id=732928
- http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html
- https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
- http://www.gossamer-threads.com/lists/apache/dev/401638
- http://securitytracker.com/id?1025960
- http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e
- http://seclists.org/fulldisclosure/2011/Aug/175
- http://www.securityfocus.com/bid/49303
- http://osvdb.org/74721
- http://blogs.oracle.com/security/entry/security_alert_for_cve_2011
- http://www.ubuntu.com/usn/USN-1199-1
- http://www.redhat.com/support/errata/RHSA-2011-1294.html
- http://www.apache.org/dist/httpd/Announcement2.2.html
- http://secunia.com/advisories/46000
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:130
- http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml
- http://secunia.com/advisories/45937
- http://www.redhat.com/support/errata/RHSA-2011-1245.html
- http://www.redhat.com/support/errata/RHSA-2011-1300.html
- http://secunia.com/advisories/46126
- http://www.kb.cert.org/vuls/id/405811
- http://www.redhat.com/support/errata/RHSA-2011-1330.html
- http://secunia.com/advisories/46125
- http://www.redhat.com/support/errata/RHSA-2011-1329.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html
- http://support.apple.com/kb/HT5002
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html
- http://marc.info/?l=bugtraq&m=131551295528105&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html
- http://marc.info/?l=bugtraq&m=131731002122529&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html
- http://www.redhat.com/support/errata/RHSA-2011-1369.html
- http://marc.info/?l=bugtraq&m=132033751509019&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html
- http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- http://marc.info/?l=bugtraq&m=134987041210674&w=2
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://marc.info/?l=bugtraq&m=133951357207000&w=2
- http://marc.info/?l=bugtraq&m=133477473521382&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69396
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E