SB2014032903 - Slackware Linux update for httpd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014032903

SB2014032903 - Slackware Linux update for httpd

Published: March 29, 2014 Updated: May 6, 2017

Security Bulletin ID SB2014032903
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2013-6438)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.


2) Input validation error (CVE-ID: CVE-2014-0098)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.


Remediation

Install update from vendor's website.

References