Multiple DoS Vulnerabilities in Apache HTTP Server

Release date:
Updated on:

Affected Systems:
Apache Group Apache HTTP Server <2.4.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 66303
CVE (CAN) ID: CVE-2013-6438, CVE-2014-0098

Apache HTTP Server is an open source HTTP Server.

Apache HTTP Server 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, and 2.4.1 have security vulnerabilities that can be exploited to cause DoS attacks.

1. When the cookie is intercepted, the mod_log_config module has an error, which can be exploited to cause the worker thread to crash. To successfully exploit this vulnerability, you need to use threaded MPM.
2. When leading spaces are deleted, the mod_dav module has a boundary error. The memory may be damaged by a specially crafted dav write request.

<* Source: Rainer M Canavan
Ning Zhang
Amin Tora

Link: http://secunia.com/advisories/57399/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://httpd.apache.org/
Http://www.apache.org/dist/httpd/CHANGES_2.4.9
Http://httpd.apache.org/security/vulnerabilities_24.html