Apache HTTP Server 'Protocol. c' Remote Denial of Service Vulnerability

Apache HTTP Server 'Protocol. c' Remote Denial of Service Vulnerability
Apache HTTP Server 'Protocol. c' Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:

Apache Group HTTP Server 2.4.12
Apache Group HTTP Server 2.2.29

Description:

Bugtraq id: 74158

Apache HTTP Server is an open-source Web Server of the Apache Software Foundation.

Apache HTTP Server 2.2.29/2.4.12 is indirectly referenced by a null pointer in implementation. Successful exploitation may cause the affected application to crash.

<* Source: Nicolas Lemonias

Link: http://www.securityfocus.com/archive/1/535273
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Nicholas Lemonias () provides the following test methods:

(.. \ Httpd-2.2.29 \ server \ protocol. c: 1286)
(.. \ Httpd-2.4.12 \ server \ protocol. c: 1286)

...

AP_CORE_DECLARE_NONSTD (apr_status_t) ap_content_length_filter (
Ap_filter_t * f,
Apr_bucket_brigade * B)
{
Request_rec * r = f-> r;
Struct content_length_ctx * ctx;
Apr_bucket * e;
Int eos = 0;
Apr_read_type_e eblock = APR_NONBLOCK_READ;

Ctx = f-> ctx;
If (! Ctx ){
F-> ctx = apr_palloc (r-> pool, sizeof (* ctx ));
Ctx-> data_sent = 0;
}

Suggestion:

Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://httpd.apache.org/

This article permanently updates the link address: