Vulnerability CVE-2009-1890: Information

Description

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Severity: HIGH (7.1)

References to Advisories, Solutions, and Tools

1. Affected configurations:

   1. Configuration 1

      cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

      Start including

      2.2.0

      End excliding

      2.2.12

      ---

      Configuration 2

      cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

      ---

      Configuration 3

      cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

      ---

      Configuration 4

      cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

      ---

      Configuration 5

      cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*

      ---