Resource management error in Apache HTTP Server

1) Resource management error

EUVDB-ID: #VU32515

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-0118

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Apache HTTP Server: 2.4.0 - 2.4.9

CPE2.3

• cpe:2.3:a:apache_foundation:apache_http_server:2.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_http_server:2.4.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_http_server:2.4.0.1:*:*:*:*:*:*:*

External links

https://advisories.mageia.org/MGASA-2014-0304.html
https://advisories.mageia.org/MGASA-2014-0305.html
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
https://marc.info/?l=bugtraq&m=143403519711434&w=2
https://marc.info/?l=bugtraq&m=143748090628601&w=2
https://marc.info/?l=bugtraq&m=144050155601375&w=2
https://marc.info/?l=bugtraq&m=144493176821532&w=2
https://rhn.redhat.com/errata/RHSA-2014-1019.html
https://rhn.redhat.com/errata/RHSA-2014-1020.html
https://rhn.redhat.com/errata/RHSA-2014-1021.html
https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES
https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c
https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c?r1=1604353&r2=1610501&diff_format=h
https://www.debian.org/security/2014/dsa-2989
https://www.mandriva.com/security/advisories?name=MDVSA-2014:142
https://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
https://www.securityfocus.com/bid/68745
https://bugzilla.redhat.com/show_bug.cgi?id=1120601
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
https://puppet.com/security/cve/cve-2014-0118
https://security.gentoo.org/glsa/201504-03
https://support.apple.com/HT204659

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.