Apache: Denial of service

Apache: Denial of service Multiple vulnerabilities in Apache might lead to a Denial of Service. apache 2008-07-09 2008-07-09 222643 227111 remote 2.2.9 2.2.9

The Apache HTTP server is one of the most popular web servers on the Internet.

Multiple vulnerabilities have been discovered in Apache:

Dustin Kirkland reported that the mod_ssl module can leak memory when the client reports support for a compression algorithm (CVE-2008-1678).
Ryujiro Shibuya reported that the ap_proxy_http_process_response() function in the mod_proxy module does not limit the number of forwarded interim responses (CVE-2008-2364).
sp3x of SecurityReason reported a Cross-Site Request Forgery vulnerability in the balancer-manager in the mod_proxy_balancer module (CVE-2007-6420).

A remote attacker could exploit these vulnerabilities by connecting to an Apache httpd, by causing an Apache proxy server to connect to a malicious server, or by enticing a balancer administrator to connect to a specially-crafted URL, resulting in a Denial of Service of the Apache daemon.

There is no known workaround at this time.

All Apache users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.9"

CVE-2007-6420 CVE-2008-1678 CVE-2008-2364 keytoaster rbu rbu