National Cyber-Alert System

Vulnerability Summary for CVE-2005-2728

Overview

The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.55: http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: apache-byterange-dos(22006)

Type: Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/22006

External Source: BID

Name: 14660

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/14660

External Source: GENTOO

Name: GLSA-200508-15

Type: Advisory; Patch Information

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200508-15.xml

External Source: CONFIRM

Name: http://issues.apache.org/bugzilla/show_bug.cgi?id=29962

Type: Advisory; Patch Information

Hyperlink:http://issues.apache.org/bugzilla/show_bug.cgi?id=29962

External Source: SECUNIA

Name: 16559

Type: Advisory

Hyperlink:http://secunia.com/advisories/16559/

External Source: UBUNTU

Name: USN-177-1

Hyperlink:http://www.ubuntu.com/usn/usn-177-1

External Source: HP

Name: HPSBUX02074

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/428138/100/0/threaded

External Source: REDHAT

Name: RHSA-2005:608

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-608.html

External Source: SUSE

Name: SUSE-SA:2005:052

Hyperlink:http://www.novell.com/linux/security/advisories/2005_52_apache2.html

External Source: SUSE

Name: SUSE-SA:2005:051

Hyperlink:http://www.novell.com/linux/security/advisories/2005_51_apache2.html

External Source: MANDRIVA

Name: MDKSA-2005:161

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:161

External Source: VUPEN

Name: ADV-2006-0789

Hyperlink:http://www.frsirt.com/english/advisories/2006/0789

External Source: DEBIAN

Name: DSA-805

Hyperlink:http://www.debian.org/security/2005/dsa-805

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

External Source: SUNALERT

Name: 102198

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1

External Source: SREASON

Name: 604

Hyperlink:http://securityreason.com/securityalert/604

External Source: SECUNIA

Name: 19072

Hyperlink:http://secunia.com/advisories/19072

External Source: SECUNIA

Name: 18517

Hyperlink:http://secunia.com/advisories/18517

External Source: SECUNIA

Name: 18333

Hyperlink:http://secunia.com/advisories/18333

External Source: SECUNIA

Name: 18161

Hyperlink:http://secunia.com/advisories/18161

External Source: SECUNIA

Name: 17923

Hyperlink:http://secunia.com/advisories/17923

External Source: SECUNIA

Name: 17831

Hyperlink:http://secunia.com/advisories/17831

External Source: SECUNIA

Name: 17600

Hyperlink:http://secunia.com/advisories/17600

External Source: SECUNIA

Name: 17288

Hyperlink:http://secunia.com/advisories/17288

External Source: SECUNIA

Name: 17036

Hyperlink:http://secunia.com/advisories/17036

External Source: SECUNIA

Name: 16956

Hyperlink:http://secunia.com/advisories/16956

External Source: SECUNIA

Name: 16789

Hyperlink:http://secunia.com/advisories/16789

External Source: SECUNIA

Name: 16769

Hyperlink:http://secunia.com/advisories/16769

External Source: SECUNIA

Name: 16754

Hyperlink:http://secunia.com/advisories/16754

External Source: SECUNIA

Name: 16753

Hyperlink:http://secunia.com/advisories/16753

External Source: SECUNIA

Name: 16746

Hyperlink:http://secunia.com/advisories/16746

External Source: SECUNIA

Name: 16743

Hyperlink:http://secunia.com/advisories/16743

External Source: SECUNIA

Name: 16714

Hyperlink:http://secunia.com/advisories/16714

External Source: SECUNIA

Name: 16705

Hyperlink:http://secunia.com/advisories/16705

External Source: TRUSTIX

Name: TSLSA-2005-0059

Hyperlink:http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

External Source: SGI

Name: 20060101-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U

US Government Resource: oval:org.mitre.oval:def:760

Name: oval:org.mitre.oval:def:760

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:760

US Government Resource: oval:org.mitre.oval:def:1727

Name: oval:org.mitre.oval:def:1727

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1727

US Government Resource: oval:org.mitre.oval:def:1246

Name: oval:org.mitre.oval:def:1246

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1246