Apache HTTP Server Prefork MPM module denial of service
| apache-child-process-dos (35095) |  Low Risk |
Description:
Apache HTTP Server when used with the Prefork MPM module could allow a local attacker to cause a denial of service. An attacker could modify the worker_score and process_score arrays in a way that would cause a SIGUSR1 signal to be sent to arbitrary child processes, resulting in a denial of service.
Platforms Affected:
- Apache, HTTP Server 1.3.37
- Apache, HTTP Server 1.3.38 Dev
- Apache, HTTP Server 2.0.59
- Apache, HTTP Server 2.0.60 Dev
- Apache, HTTP Server 2.2.4
- Apache, HTTP Server 2.2.5 Dev
- Avaya, Application Enablement Services
- Avaya, Communication Manager 2.0
- Avaya, Communication Manager 2.0.1
- Avaya, Communication Manager 2.1
- Avaya, Communication Manager 2.1.1
- Avaya, Communication Manager 2.2
- Avaya, Communication Manager 2.2.1
- Avaya, Communication Manager 2.2.2
- Avaya, Communication Manager 3.0
- Avaya, Communication Manager 3.0.1
- Avaya, Communication Manager 3.1
- Avaya, Communication Manager 3.1.1
- Avaya, Communication Manager 3.1.2
- Avaya, Communication Manager 3.1.3
- Avaya, Communication Manager 3.1.4
- Avaya, Communication Manager 4.0
- Avaya, Communication Manager 4.0.1
- Avaya, Communication Manager 4.0.3
- Avaya, Converged Communications Server 2.0
- Avaya, Converged Communications Server 2.0.1
- Avaya, Converged Communications Server 2.1
- Avaya, Converged Communications Server 3.0
- Avaya, Converged Communications Server 3.1
- Avaya, Converged Communications Server 3.1.1
- Avaya, Converged Communications Server 3.1.2
- Avaya, Converged Communications Server 4.0
- Avaya, Expanded Meet-Me Conferencing
- Avaya, Intuity Audix LX
- Avaya, Message Networking
- Avaya, Message Storage Server 3.0
- Avaya, Message Storage Server
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Canonical, Ubuntu 7.04
- FUJITSU, Interstage Application Server Ent. Ed 5.0 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 5.0 (Turbolinux)
- FUJITSU, Interstage Application Server Ent. Ed 5.0.1 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 6.0 (RHEL)
- FUJITSU, Interstage Application Server Ent. Ed 6.0 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 7.0 (RHEL)
- FUJITSU, Interstage Application Server Ent. Ed 7.0 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 7.0.1 (RHEL)
- FUJITSU, Interstage Application Server Ent. Ed 7.0.1 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 8.0.0 (RHEL)
- FUJITSU, Interstage Application Server Ent. Ed 8.0.0 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 8.0.2 (RHEL)
- FUJITSU, Interstage Application Server Ent. Ed 8.0.2 (Solaris)
- FUJITSU, Interstage Application Server Ent. Ed 9.0.0 Solaris
- FUJITSU, Interstage Application Server Ent. Ed 9.0.0 RHEL
- FUJITSU, Interstage Application Server Plus 7.0 (RHEL)
- FUJITSU, Interstage Application Server Plus 7.0 (Solaris)
- FUJITSU, Interstage Application Server Plus 7.0.1 (RHEL)
- FUJITSU, Interstage Application Server Plus 7.0.1 (Solaris)
- FUJITSU, Interstage Application Server Std Ed 5.0 (Solaris)
- FUJITSU, Interstage Application Server Std Ed 5.0 (Turbolinux)
- FUJITSU, Interstage Application Server Std J 8.0.0 (RHEL)
- FUJITSU, Interstage Application Server Std J 8.0.2 (RHEL)
- FUJITSU, Interstage Application Server Std J 9.0.0 RHEL
- FUJITSU, Interstage Application Server Std. J 8.0.0 (Solaris)
- FUJITSU, Interstage Application Server Web - J Ed 5.0 (Solaris)
- FUJITSU, Interstage Application Server Web - J Ed 5.0 (Turbolinux)
- FUJITSU, Interstage Business App. Server Ent. Ed 8.0.0 (RHEL)
- FUJITSU, Interstage Job Workload Server 8.1.0 (RHEL)
- Gentoo, Linux
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
- HP, HP-UX B.11.31
- IBM, HTTP Server 2.0.47
- IBM, HTTP Server 6.0.2.22
- IBM, HTTP Server 6.1
- IBM, HTTP Server 6.1.0.12
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- Novell, Linux Desktop 9
- Novell, Linux Desktop 9 SDK
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, OpenSUSE 10.2
- Novell, OpenSUSE 10.3
- Novell, SLE SDK 10 SP1
- Novell, SUSE Linux Enterprise Desktop 10 SP1
- Novell, SUSE Linux Enterprise Server 10
- Novell, SUSE Linux Enterprise Server 10 SP1
- RedHat, Application Stack v1 for EL AS 4
- RedHat, Application Stack v1 for EL ES 4
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux Desktop 5.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- RedHat, Network Proxy 4.2
- RedHat, Network Proxy 5.0
- RedHat, Network Satellite Server 4.2
- RedHat, Network Satellite Server 5.0
- SuSE, SLE SDK 10
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 10.1
- SuSE, SuSE SLES 9
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux Appliance Server 2.0
Remedy:
Upgrade to the latest version of Apache (1.3.39 or later), (2.0.61 or later) or (2.2.6 or later), available from the Apache Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Denial of Service
References:
- Apache Web site, Welcome! - The Apache HTTP Server Project at http://httpd.apache.org/.
- APAR PK50467, CVE-2007-3304 MPM SIGNALLING VULNERABILITY at http://www-1.ibm.com/support/docview.wss?uid=swg1PK50467.
- APAR PK52702, Z/OS IBM HTTP SERVER FOR WEBSPHERE (POWERED BY APACHE) FIX PACK 6.1.0.13 at http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702.
- APAR PK53584, IBM HTTP SERVER 2.0.47 CUMULATIVE E-FIX at http://www-1.ibm.com/support/docview.wss?rs=203&context=SW000&dc=DB550&dc=D100&q1=Security+vulnerability&uid=swg1PK53584&loc=en_US&cs=UTF-8<=all.
- APAR PK53984, SHIP APAR FIXES FOR H28W601 FIX PACK 6.0.2.23. at http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984.
- BugTraq Mailing List, Tue May 29 2007 - 13:00:42 CDT , Apache httpd vulenrabilities at http://archives.neohapsis.com/archives/bugtraq/2007-05/0415.html.
- FUJITSU Web site, Cross site scripting (XSS) and denial of service (DoS) vulnerabilities in Interstage HTTP Server. January 22nd, 2008 at http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html.
- HPSBUX02273 SSRT071476, HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01182588&jumpid=reg_R1002_USEN.
- Sun Alert ID: 103179, Security Vulnerabilities in the Apache 1.3 and 2.0 Web Server Daemon and "mod_status" Module May Lead to Cross Site Scripting (XSS) or Denial of Service (DoS). at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1.
- ASA-2007-288: Apache security update (RHSA-2007-0532)
- ASA-2007-353: httpd security update (RHSA-2007-0557)
- ASA-2007-363: httpd security update (RHSA-2007-0662)
- ASA-2007-420: HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) (HPSBUX02273)
- ASA-2008-012: Security Vulnerabilities in the Apache 1.3 and 2.0 Web Server Daemon and "mod_status" Module May Lead to Cross Site Scripting (XSS) or Denial of Service (DoS) (SUN 103179)
- BID-24215: Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
- CVE-2007-3304: Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka SIGUSR1 killer.
- GLSA-200711-06: Apache: Multiple vulnerabilities
- MDKSA-2007:140: Updated apache packages fix multiple security issues
- MDKSA-2007:142: Updated apache packages fix multiple security issues
- RHSA-2007-0532: Moderate: apache security update
- RHSA-2007-0556: Moderate: httpd security update
- RHSA-2007-0557: Moderate: httpd security update
- RHSA-2007-0662: Moderate: httpd security update
- RHSA-2008-0261: Moderate: Red Hat Network Satellite Server security update
- RHSA-2008-0263: Low: Red Hat Network Proxy Server security update
- RHSA-2008-0523: Low: Red Hat Network Proxy Server security update
- RHSA-2008-0524: Low: Red Hat Network Satellite Server security update
- SA26273: Apache Denial of Service and Cross-Site Scripting
- SA26508: Avaya Products Perl Net::DNS and Apache Vulnerabilities
- SA26611: Avaya Products Apache Multi-Processing Module Denial of Service
- SA26759: IBM HTTP Server Multi-Processing Module Denial of Service
- SA26993: IBM WebSphere Application Server for z/OS HTTP Server Vulnerabilities
- SA27121: WebSphere Application Server for z/OS HTTP Server Denial of Service
- SA28212: Sun Solaris Apache Cross-Site Scripting and Denial of Service
- SA28224: Sun Solaris Apache Cross-Site Scripting and Denial of Service
- SA28606: Interstage HTTP Server Multiple Vulnerabilities
- SECTRACK ID: 1018304: Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
- SUSE-SA:2007:061: Apache2 security issues
- USN-499-1: Apache vulnerabilities
- VUPEN/ADV-2007-2727: Apache Security Update Fixes Denial of Service and Cross Site Scripting Issues
- VUPEN/ADV-2007-3100: IBM HTTP Server Signals Processing Local Denial of Service Vulnerability
- VUPEN/ADV-2007-3283: IBM HTTP Server for WebSphere Security Bypass and Denial of Service
- VUPEN/ADV-2007-3420: IBM WebSphere Application Server for z/OS Local Denial of Service Issue
- VUPEN/ADV-2007-3494: HP-UX Security Update Fixes Apache Denial of Service Vulnerabilities
- VUPEN/ADV-2007-4305: Sun Solaris HTTP server Cross Site Scripting and Denial of Service Issues
Reported:
May 29, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net