#VU32516 Heap-based buffer overflow in Apache HTTP Server - CVE-2014-0226

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32516

#VU32516 Heap-based buffer overflow in Apache HTTP Server - CVE-2014-0226

Published: July 20, 2014 / Updated: July 29, 2020


Vulnerability identifier: #VU32516
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2014-0226
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Apache HTTP Server
Software vendor:
Apache Foundation

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Race condition in the mod_status module in the Apache HTTP Server before 2.4.10. A remote attacker can use a crafted request that triggers improper scoreboard handling within the status_handler function in modules to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Update to version 2.4.10.

External links