Apache HTTP Server HTTP GET request denial of service
| apache-http-get-dos (17930) |  Low Risk |
Description:
Apache HTTP Server is vulnerable to a denial of service attack. By sending a specially-crafted HTTP GET requests, a remote attacker could cause the server to consume all available CPU resources and hang.
Platforms Affected:
- Apache, HTTP Server 2.0
- Apache, HTTP Server 2.0 A9
- Apache, HTTP Server 2.0.28 Beta
- Apache, HTTP Server 2.0.28
- Apache, HTTP Server 2.0.32
- Apache, HTTP Server 2.0.32 Beta
- Apache, HTTP Server 2.0.34 Beta
- Apache, HTTP Server 2.0.35
- Apache, HTTP Server 2.0.36
- Apache, HTTP Server 2.0.37
- Apache, HTTP Server 2.0.38
- Apache, HTTP Server 2.0.39
- Apache, HTTP Server 2.0.40
- Apache, HTTP Server 2.0.41
- Apache, HTTP Server 2.0.42
- Apache, HTTP Server 2.0.43
- Apache, HTTP Server 2.0.44
- Apache, HTTP Server 2.0.45
- Apache, HTTP Server 2.0.46
- Apache, HTTP Server 2.0.47
- Apache, HTTP Server 2.0.48
- Apache, HTTP Server 2.0.49
- Apache, HTTP Server 2.0.50
- Apache, HTTP Server 2.0.51
- Apache, HTTP Server 2.0.52
- Canonical, Ubuntu 4.10
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- Trustix, Secure Linux 2.0
- Trustix, Secure Linux 2.1
- Trustix, Secure Linux 2.2
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux Home
Remedy:
For Gentoo Linux:
Upgrade to the latest version of apache (2.0.52-r1, < 2.0 or later), as listed in GLSA 200411-18. See References.
For Ubuntu Linux:
Upgrade to the latest apache2 package (2.0.50-12ubuntu4.1 or later), as listed in USN-23-1 November 11, 2004. See References.
For Red Hat Linux:
Upgrade to the latest httpd package, as listed below. Refer to RHSA-2004:562-11 for more information. See References.
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 2.0.46-44.ent.x86_64 or later
For Mandrake Linux:
Upgrade to the latest apache2 package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:135 for more information. See References.
Mandrake Linux 10.1: 2.0.50-7.2.101mdk or later
Mandrake Linux 9.2: 2.0.47-6.12.92mdk or later
Mandrake Linux 10.0: 2.0.48-6.8.100mdk or later
For Trustix Secure Linux:
Upgrade to the latest apache package, as listed below. Refer to Trustix Secure Linux Security Advisory #2004-0061 for more information. See References.
Trustix Secure Linux 2.2: 2.0.52-6tr or later
Trustix Secure Linux 2.1: 2.0.52-0.2tr or later
Trustix Secure Linux 2.0: 2.0.52-0.1tr or later
For TurboLinux:
Upgrade to the latest httpd package (2.0.51-8 or later), as listed in Turbolinux Security Advisory TLSA-2005-2. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Mon Nov 01 2004 - 09:38:42 CST, Re: [Full-Disclosure] DoS in Apache 2.0.52 ? at http://archives.neohapsis.com/archives/fulldisclosure/2004-10/1206.html.
- CIAC Information Bulletin P-276, Apple Security Update 2005-007 at http://www.ciac.org/ciac/bulletins/p-276.shtml.
- Full-Disclosure Mailing List, Mon Nov 01 2004 - 03:57:42 CST , DoS in Apache 2.0.52 ? at http://archives.neohapsis.com/archives/fulldisclosure/2004-10/1195.html.
- IBM Systems Support Web site, Support for HMC at https://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v61.Readme.html#MH01110.
- Trustix Secure Linux Security Advisory #2004-0061, Multiple vulnerabilities at http://www.trustix.net/errata/2004/0061/.
- CVE-2004-0942: Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
- FrSIRT/ADV-2006-0789: Sun Security Update Fixes Multiple Apache Web Server Vulnerabilities
- GLSA-200411-18: Apache 2.0: Denial of Service by memory consumption
- MDKSA-2004:135: Updated apache2 packages fix request DoS
- RHSA-2004-562: httpd security update
- SA19072: Sun Solaris Multiple Apache2 Vulnerabilities
- SUSE-SR:2004:001: SUSE Security Summary Report
Reported:
Nov 01, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net