Resource exhaustion in Apache HTTP Server - CVE-2011-3192
Published: December 27, 2016 / Updated: March 14, 2017
Vulnerability identifier: #VU2934
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-3192
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS conditions on the target system.
The weakness exists due to an error in the ByteRange filter when processing malicious requests in Apache HTTP server. A remote attacker can send a specially crafted HTTP request containing an overly large Range header, exhaust all available memory resources and trigger the application to crash.
Successful exploitation of the vulnerability results in denial service on the vulnerable system.
Note: the vulnerability was being actively exploited.
The weakness exists due to an error in the ByteRange filter when processing malicious requests in Apache HTTP server. A remote attacker can send a specially crafted HTTP request containing an overly large Range header, exhaust all available memory resources and trigger the application to crash.
Successful exploitation of the vulnerability results in denial service on the vulnerable system.
Note: the vulnerability was being actively exploited.
Affected software
Apache HTTP Server
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
SUSE Linux
Slackware Linux
apache2 (Alpine package)
HP Onboard Administrator
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
SUSE Linux
Slackware Linux
apache2 (Alpine package)
HP Onboard Administrator
How to mitigate CVE-2011-3192
Upgrade to the latest version of Apache HTTP Server 2.2.20 or 2.0.65.
apache2 (Alpine package) - update to 2.2.20-r0
HP Onboard Administrator - update to 3.55
HP Onboard Administrator - update to 3.55
Links to Public Exploits and PoC-codes
- Exploit #2178 - Exploits (Exploits by 1N3 @CrowdShield @xer0dayz @XeroSecurity) (March 18, 2020)
- Exploit #17 - Apache Range Header DoS (Apache Killer) (March 18, 2020)
- Exploit #111 - CVE-2011-3192 (Apache Range Header DoS Exploit) (March 18, 2020)
- Exploit #656 - Apache - Denial of Service (March 18, 2020)
- Exploit #657 - Apache - Remote Denial of Service (Memory Exhaustion) (March 18, 2020)
External References
Related Security Bulletins
- Denial of service in Apache HTTP Server
- Ubuntu update for Apache
- Slackware Linux update for httpd
- Amazon Linux AMI update for httpd
- SUSE Linux update for Apache
- SUSE Linux update for Apache
- openSUSE update for flash-player
- Red Hat update for httpd
- Resource exhaustion in apache2 (Alpine package)
- SUSE Linux update for Apache2
- Slackware Linux update for httpd
- Resource exhaustion in HP Onboard Administrator (OA)