CIA RESEARCH

Alerts

[CIA-1035-Alert-ap1] Apache Denial of Service via Memory Leak in MPM 'worker.c'

Summary:

A vulnerability in Apache webserver 2.x and the IBM HTTP Server may allow an attacker to render a server incapable of processing incoming requests.

Technical Details:

A memory leak in the Apache worker MPM (Multi-Processing Module) may allow an attacker to cause excess system resource consumption by aborting connections. Memory reserved for the connection request is improperly freed for use by other processes, resulting in the eventual inability for the server to handle incoming requests. The vulnerability also affects the IBM HTTP Server which is based on the Apache codebase.

Solution:

Apply the appropriate patches provided at the links below:

Apache SVN security Fix

IBM HTTP Security Fix

CVE Reference:

CVE-2005-2970

SecurityTracker Number(s):

1015093

Vendor URL:

IBM

Apache

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic?s research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing ? that?s what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm? the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic?s customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC