|
|
Family: Denial of Service --> Category: infos
Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for version of Apache
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server is prone to multiple denial of service attacks.
Description :
The remote host appears to be running a version of Apache 2.x which is
older than 2.0.50.
There is denial of service flaw in Apache 2.0.x that can be triggered
by sending a specially-crafted HTTP request, which results in the
consumption of an arbitrary amount of memory. On 64-bit systems with
more than 4GB virtual memory, this may lead to heap based buffer
overflow.
There is also a denial of service vulnerability in mod_ssl's
'ssl_io_filter_cleanup' function. By sending a request to vulnerable
server over SSL and closing the connection before the server can send
a response, a possible hacker can cause a memory violation that crashes the
server.
See also :
http://www.guninski.com/httpd1.html
Solution :
Upgrade to Apache 2.0.50 or newer.
Threat Level:
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:N/A:P/I:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
