ISS X-Force Database: apache-child-process-dos(35095): Apache HTTP Server Prefork MPM module denial of service

Apache HTTP Server Prefork MPM module denial of service

apache-child-process-dos (35095)

Low Risk

Description:

Apache HTTP Server when used with the Prefork MPM module could allow a local attacker to cause a denial of service. An attacker could modify the worker_score and process_score arrays in a way that would cause a SIGUSR1 signal to be sent to arbitrary child processes, resulting in a denial of service.

Platforms Affected:

Apache, HTTP Server 1.3.37
Apache, HTTP Server 1.3.38 Dev
Apache, HTTP Server 2.0.59
Apache, HTTP Server 2.0.60 Dev
Apache, HTTP Server 2.2.4
Apache, HTTP Server 2.2.5 Dev
Avaya, AES
Avaya, CCS/SES SES 4.0 and prior
Avaya, Communication Manager 2.x
Avaya, Communication Manager 3.x
Avaya, Communication Manager 4.x
Avaya, EMMC
Avaya, Intuity Audix LX
Avaya, Message Networking
Avaya, Messaging Storage Server 3.x
Avaya, Messaging Storage Server
Canonical, Ubuntu 6.06 LTS
Canonical, Ubuntu 6.10
Canonical, Ubuntu 7.04
FUJITSU, Interstage Application Server Ent. Ed 5.0 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 5.0 (Turbolinux)
FUJITSU, Interstage Application Server Ent. Ed 5.0.1 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 6.0 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 6.0 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 7.0 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 7.0 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 7.0.1 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 7.0.1 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 8.0.0 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 8.0.0 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 8.0.2 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 8.0.2 (Solaris)
FUJITSU, Interstage Application Server Ent. Ed 9.0.0 (RHEL)
FUJITSU, Interstage Application Server Ent. Ed 9.0.0 (Solaris)
FUJITSU, Interstage Application Server Plus 7.0 (RHEL)
FUJITSU, Interstage Application Server Plus 7.0 (Solaris)
FUJITSU, Interstage Application Server Plus 7.0.1 (RHEL)
FUJITSU, Interstage Application Server Plus 7.0.1 (Solaris)
FUJITSU, Interstage Application Server Std Ed 5.0 (Solaris)
FUJITSU, Interstage Application Server Std Ed 5.0 (Turbolinux)
FUJITSU, Interstage Application Server Std J 8.0.0 (RHEL)
FUJITSU, Interstage Application Server Std J 8.0.2 (RHEL)
FUJITSU, Interstage Application Server Std J 9.0.0 (RHEL)
FUJITSU, Interstage Application Server Std. J 8.0.0 (Solaris)
FUJITSU, Interstage Application Server Web - J Ed 5.0 (Solaris)
FUJITSU, Interstage Application Server Web - J Ed 5.0 (Turbolinux)
FUJITSU, Interstage Business App. Server Ent. Ed 8.0.0 (RHEL)
FUJITSU, Interstage Job Workload Server 8.1.0 (RHEL)
Gentoo, Linux
HP, HP-UX B.11.11
HP, HP-UX B.11.23
HP, HP-UX B.11.31
IBM, HTTP Server 2.0.47
IBM, HTTP Server prior to 6.0.2.23
IBM, HTTP Server prior to 6.1.0.13
IBM, HTTP Server for WebSphere 6.1.0 on z/OS
Mandriva, Corporate Server 3.0 X86_64
Mandriva, Corporate Server 3.0
Mandriva, Corporate Server 4.0
Mandriva, Corporate Server 4.0 X86_64
Mandriva, Linux 2007 X86_64
Mandriva, Linux 2007
Mandriva, Linux 2007.1 X86_64
Mandriva, Linux 2007.1
Mandriva, Linux 2008.0 X86_64
Novell, Linux Desktop 9
Novell, Linux Desktop 9 SDK
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, OpenSUSE 10.2
Novell, OpenSUSE 10.3
Novell, SLE SDK 10 SP1
Novell, SUSE Linux Enterprise Desktop 10 SP1
Novell, SUSE Linux Enterprise Server 10
Novell, SUSE Linux Enterprise Server 10 SP1
RedHat, Enterprise Linux 2.1 AS
RedHat, Enterprise Linux 2.1 ES
RedHat, Enterprise Linux 2.1 WS
RedHat, Enterprise Linux 3 Desktop
RedHat, Enterprise Linux 3 AS
RedHat, Enterprise Linux 3 WS
RedHat, Enterprise Linux 3 ES
RedHat, Enterprise Linux 4 AS
RedHat, Enterprise Linux 4 ES
RedHat, Enterprise Linux 4 Desktop
RedHat, Enterprise Linux 4 WS
RedHat, Enterprise Linux 5 Client Workstation
RedHat, Enterprise Linux 5
RedHat, Enterprise Linux 5 Client
RedHat, Enterprise Linux Desktop 5.0
RedHat, Linux Advanced Workstation 2.1 Itanium
RedHat, Network Proxy 4.2
RedHat, Network Proxy 5.0
RedHat, Network Satellite Server 4.2
RedHat, Network Satellite Server 5.0
RedHat, Red Hat Application Stack v1 for EL AS 4
RedHat, Red Hat Application Stack v1 for EL ES 4
SuSE, SLE SDK 10
SuSE, SuSE Linux 10.0
SuSE, SuSE Linux 10.1
SuSE, SuSE SLES 9
Turbolinux, Turbolinux 10 Server
Turbolinux, Turbolinux 10 Server x64 Ed
Turbolinux, Turbolinux FUJI
Turbolinux, Turbolinux Appliance Server 2.0

Remedy:

Upgrade to the latest version of Apache (1.3.39 or later), (2.0.61 or later) or (2.2.6 or later), available from the Apache Web site. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Denial of Service

References:

Apache Web site, Welcome! - The Apache HTTP Server Project at http://httpd.apache.org/.
APAR PK50467, CVE-2007-3304 MPM SIGNALLING VULNERABILITY at http://www-1.ibm.com/support/docview.wss?uid=swg1PK50467.
APAR PK52702, Z/OS IBM HTTP SERVER FOR WEBSPHERE (POWERED BY APACHE) FIX PACK 6.1.0.13 at http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702.
APAR PK53584, IBM HTTP SERVER 2.0.47 CUMULATIVE E-FIX at http://www-1.ibm.com/support/docview.wss?rs=203&context=SW000&dc=DB550&dc=D100&q1=Security+vulnerability&uid=swg1PK53584&loc=en_US&cs=UTF-8<=all.
APAR PK53984, SHIP APAR FIXES FOR H28W601 FIX PACK 6.0.2.23. at http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984.
BugTraq Mailing List, Tue May 29 2007 - 13:00:42 CDT , Apache httpd vulenrabilities at http://archives.neohapsis.com/archives/bugtraq/2007-05/0415.html.
FUJITSU Web site, Cross site scripting (XSS) and denial of service (DoS) vulnerabilities in Interstage HTTP Server. January 22nd, 2008 at http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html.
HPSBUX02273 SSRT071476, HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01182588&jumpid=reg_R1002_USEN.
Sun Alert ID: 103179, Security Vulnerabilities in the Apache 1.3 and 2.0 Web Server Daemon and "mod_status" Module May Lead to Cross Site Scripting (XSS) or Denial of Service (DoS). at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1.
ASA-2007-288: Apache security update (RHSA-2007-0532)
ASA-2007-353: httpd security update (RHSA-2007-0557)
ASA-2007-363: httpd security update (RHSA-2007-0662)
ASA-2007-420: HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) (HPSBUX02273)
ASA-2008-012: Security Vulnerabilities in the Apache 1.3 and 2.0 Web Server Daemon and "mod_status" Module May Lead to Cross Site Scripting (XSS) or Denial of Service (DoS) (SUN 103179)
BID-24215: Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
CVE-2007-3304: Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka SIGUSR1 killer.
FrSIRT/ADV-2007-2727: Apache Security Update Fixes Denial of Service and Cross Site Scripting Issues
FrSIRT/ADV-2007-3100: IBM HTTP Server Signals Processing Local Denial of Service Vulnerability
FrSIRT/ADV-2007-3283: IBM HTTP Server for WebSphere Security Bypass and Denial of Service
FrSIRT/ADV-2007-3420: IBM WebSphere Application Server for z/OS Local Denial of Service Issue
FrSIRT/ADV-2007-3494: HP-UX Security Update Fixes Apache Denial of Service Vulnerabilities
FrSIRT/ADV-2007-4305: Sun Solaris HTTP server Cross Site Scripting and Denial of Service Issues
GLSA-200711-06: Apache: Multiple vulnerabilities
MDKSA-2007:140: Updated apache packages fix multiple security issues
MDKSA-2007:142: Updated apache packages fix multiple security issues
RHSA-2007-0532: Moderate: apache security update
RHSA-2007-0556: Moderate: httpd security update
RHSA-2007-0557: Moderate: httpd security update
RHSA-2007-0662: Moderate: httpd security update
RHSA-2008-0261: Moderate: Red Hat Network Satellite Server security update
RHSA-2008-0263: Low: Red Hat Network Proxy Server security update
RHSA-2008-0523: Low: Red Hat Network Proxy Server security update
RHSA-2008-0524: Low: Red Hat Network Satellite Server security update
SA26273: Apache Denial of Service and Cross-Site Scripting
SA26508: Avaya Products Perl Net::DNS and Apache Vulnerabilities
SA26611: Avaya Products Apache Multi-Processing Module Denial of Service
SA26759: IBM HTTP Server Multi-Processing Module Denial of Service
SA26993: IBM WebSphere Application Server for z/OS HTTP Server Vulnerabilities
SA27121: WebSphere Application Server for z/OS HTTP Server Denial of Service
SA28212: Sun Solaris Apache Cross-Site Scripting and Denial of Service
SA28224: Sun Solaris Apache Cross-Site Scripting and Denial of Service
SA28606: Interstage HTTP Server Multiple Vulnerabilities
SECTRACK ID: 1018304: Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
SUSE-SA:2007:061: Apache2 security issues
USN-499-1: Apache vulnerabilities

Reported:

May 29, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page