Skip to Content.
Sympa Menu

sm-security - [SM-Security] apache2 DoS vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] apache2 DoS vulnerability
  • Date: Sun, 28 Aug 2005 23:17:58 +0200

Synopsis
========
A bug in Apache may allow a remote attacker to perform a Denial of
Service attack.

Background
==========
Apache is the world's most popular HTTP server, being quite possibly the
best around in terms of functionality, efficiency, security and speed.

Description
===========
Filip Sneppe discovered that Apache improperly handles byterange
requests to CGI scripts. This could be used to exhaust RAM and swap on
the server, resulting in a DoS of the server.

Affected packages
=================
apache2 in all grimoires is affected. This is now fixed in devel, test,
stable-rc 0.2 and stable 0.1 grimoires.

Resolution
==========
All apache2 users should upgrade to the latest available version:
# scribe update
# cast -c apache2

References
==========
[ 1 ] ASF Bugzilla Bug 29962
http://issues.apache.org/bugzilla/show_bug.cgi?id=29962
[ 2 ] GLSA 200508-15
http://security.gentoo.org/glsa/glsa-200508-15.xml

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] apache2 DoS vulnerability, Thomas Houssin, 08/28/2005

Archive powered by MHonArc 2.6.24.

Top of Page