National Cyber-Alert System

Vulnerability Summary for CVE-2007-6422

Overview

The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.2.8. http://httpd.apache.org/security/vulnerabilities_22.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-1695

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html

External Source: FEDORA

Name: FEDORA-2008-1711

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html

External Source: XF

Name: apache-modproxybalancer-dos(39476)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39476

External Source: UBUNTU

Name: USN-575-1

Hyperlink:http://www.ubuntu.com/usn/usn-575-1

External Source: BID

Name: 27236

Hyperlink:http://www.securityfocus.com/bid/27236

External Source: BUGTRAQ

Name: 20080110 SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486169/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0009

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0009.html

External Source: REDHAT

Name: RHSA-2008:0008

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0008.html

External Source: MANDRIVA

Name: MDVSA-2008:016

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:016

External Source: VUPEN

Name: ADV-2008-0048

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2008/0048

External Source: SREASON

Name: 3523

Hyperlink:http://securityreason.com/securityalert/3523

External Source: GENTOO

Name: GLSA-200803-19

Hyperlink:http://security.gentoo.org/glsa/glsa-200803-19.xml

External Source: SECUNIA

Name: 29640

Type: Advisory

Hyperlink:http://secunia.com/advisories/29640

External Source: SECUNIA

Name: 29348

Type: Advisory

Hyperlink:http://secunia.com/advisories/29348

External Source: SECUNIA

Name: 28977

Type: Advisory

Hyperlink:http://secunia.com/advisories/28977

External Source: SECUNIA

Name: 28749

Type: Advisory

Hyperlink:http://secunia.com/advisories/28749

External Source: SECUNIA

Name: 28526

Type: Advisory

Hyperlink:http://secunia.com/advisories/28526

External Source: SUSE

Name: SUSE-SA:2008:021

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

External Source: CONFIRM

Name: http://httpd.apache.org/security/vulnerabilities_22.html

Hyperlink:http://httpd.apache.org/security/vulnerabilities_22.html