apache2: denial of service [LWN.net]

Package(s):

apache2

CVE #(s):

CVE-2007-1863

Created:

November 19, 2007

Updated:

February 18, 2008

Description:

From the CVE entry:

cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.

Alerts:

Fedora	FEDORA-2008-1711	2008-02-15
SuSE	SUSE-SA:2007:061	2007-11-19

(Log in to post comments)

apache2: denial of service

Posted Feb 21, 2008 22:41 UTC (Thu) by kmccarty (subscriber, #12085) [Link]

FYI, this was fixed sometime prior to the latest Debian "Etch" release, 4.0r3, in apache2 version 2.2.3-4+etch2. For some reason it was not deemed necessary to issue a Debian Security Advisory, but people with the usual lines in their sources.list should get the update automatically on their next APT update and upgrade.