Vulnerability identifier: #VU32516
Vulnerability risk: Medium
CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-122
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
Apache HTTP Server
Server applications /
Web servers
Vendor: Apache Foundation
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Race condition in the mod_status module in the Apache HTTP Server before 2.4.10. A remote attacker can use a crafted request that triggers improper scoreboard handling within the status_handler function in modules to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Mitigation
Update to version 2.4.10.
Vulnerable software versions
Apache HTTP Server: 2.4.0 - 2.4.9
External links
http://advisories.mageia.org/MGASA-2014-0304.html
http://advisories.mageia.org/MGASA-2014-0305.html
http://httpd.apache.org/security/vulnerabilities_24.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://marc.info/?l=bugtraq&m=143403519711434&w=2
http://marc.info/?l=bugtraq&m=143748090628601&w=2
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://marc.info/?l=bugtraq&m=144493176821532&w=2
http://rhn.redhat.com/errata/RHSA-2014-1019.html
http://rhn.redhat.com/errata/RHSA-2014-1020.html
http://rhn.redhat.com/errata/RHSA-2014-1021.html
http://seclists.org/fulldisclosure/2014/Jul/114
http://secunia.com/advisories/60536
http://security.gentoo.org/glsa/glsa-201408-12.xml
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=h
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=h
http://www.debian.org/security/2014/dsa-2989
http://www.exploit-db.com/exploits/34133
http://www.mandriva.com/security/advisories?name=MDVSA-2014:142
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/109216
http://www.securityfocus.com/bid/68678
http://zerodayinitiative.com/advisories/ZDI-14-236/
http://bugzilla.redhat.com/show_bug.cgi?id=1120603
http://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246
http://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
http://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
http://puppet.com/security/cve/cve-2014-0226
http://security.gentoo.org/glsa/201504-03
http://support.apple.com/HT204659
http://www.povonsec.com/apache-2-4-7-exploit/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.