CIA RESEARCH
Alerts
[CIA-1033-Alert] Apache Memory Leak in byterange filter allows Denial of Service
Summary:
A vulnerability in Apache 2.x allows a remote attacker to cause a
denial-of-service under certain conditions.
Technical Details:
A memory leak exists in the ap_byterange_filter() for Apache Server 2.x.
An attacker can send specially crafted HTTP request to a vulnerable server and cause excessive
memory consumption by the Apache process. The byterange filter in Apache 2.x buffers the entire
HTTP response to a particular request, causing repeated requests to CGI scripts on the target
server to result in system instability, slowdown, and the eventual crash the web server.
Solution:
A fix is available for /modules/http/http_protocol.c for Apache that
eliminates the vulnerability. Additional information is available at the link below:
Apache Software Foundation Bugzilla Bug 29962
CVE Reference:
CAN-2005-2728
GENERIC-MAP-NOMATCH
SecurityTracker Number(s):
1014826
Vendor URL:
http://httpd.apache.org/
About the Cenzic CIA Team:
Cenzic Intelligent Analysis (CIA) is Cenzic’s
research arm that focuses on continuous research for application vulnerabilities.
Industry Research, Vulnerability assessment, penetration testing, and security
testing — that’s what Cenzic Intelligent Analysis Research is all about.
Cenzic has dedicated experts whose sole job is to perform ongoing research to
find not only common vulnerabilities but also vulnerabilities found in customer
applications and make them available to our customers and to the community at large.
About Cenzic:
Cenzic provides Hailstorm® the revolutionary enterprise
software suite for automated application security assessment and compliance that
allows corporations and government organizations to dramatically improve the
security of commercial and custom applications. Hailstorm enables security experts,
QA professionals, and developers to work together to assess, analyze, and remediate
applications for security vulnerabilities, and verify compliance with security policies.
Benefits include reduced security risk and liability, lower development and testing
costs, and faster time-to-market. Cenzic’s customers are currently in the financial
services and
e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC
|
