Lucene search

K
zdiAKAT-122733db72ab3ed94b5f8a1ffcde850251fe6f466Marek KroemekeZDI-14-239
HistoryJul 18, 2014 - 12:00 a.m.

Apache HTTP Server mod_proxy Denial Of Service Vulnerability

2014-07-1800:00:00
AKAT-122733db72ab3ed94b5f8a1ffcde850251fe6f466Marek Kroemeke
www.zerodayinitiative.com
27

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.965 High

EPSS

Percentile

99.6%

This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Apache HTTP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mod_proxy module. The issue lies in the processing of HTTP headers when an invalid request is made. An attacker can leverage this flaw to crash a remote instance of Apache HTTP server.

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.965 High

EPSS

Percentile

99.6%