Apache: Denial of Service

Security Team Contact Address

Updated July 09, 2008

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200807-06 / apache
Release Date	July 09, 2008
Latest Revision	July 09, 2008: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
www-servers/apache	< 2.2.9	>= 2.2.9	All supported architectures

Related bugreports: #222643, #227111

Synopsis

Multiple vulnerabilities in Apache might lead to a Denial of Service.

2. Impact Information

Background

The Apache HTTP server is one of the most popular web servers on the Internet.

Description

Multiple vulnerabilities have been discovered in Apache:

Dustin Kirkland reported that the mod_ssl module can leak memory when the client reports support for a compression algorithm (CVE-2008-1678).
Ryujiro Shibuya reported that the ap_proxy_http_process_response() function in the mod_proxy module does not limit the number of forwarded interim responses (CVE-2008-2364).
sp3x of SecurityReason reported a Cross-Site Request Forgery vulnerability in the balancer-manager in the mod_proxy_balancer module (CVE-2007-6420).

Impact

A remote attacker could exploit these vulnerabilities by connecting to an Apache httpd, by causing an Apache proxy server to connect to a malicious server, or by enticing a balancer administrator to connect to a specially-crafted URL, resulting in a Denial of Service of the Apache daemon.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Apache users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.9"

4. References