(HP Issues Fix for HP-UX) Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1015228
|
|
SecurityTracker URL: http://securitytracker.com/id?1015228
|
|
CVE Reference: CVE-2005-2728
(Links to External Site)
|
Updated: Mar 17 2006
|
Original Entry Date: Nov 16 2005
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: HP Security Bulletin
|
Description: A vulnerability was reported in Apache. A remote user can cause denial of service conditions.
The ap_byterange_filter() function does not properly buffer responses in memory. A remote user can send specially crafted HTTP requests
to a CGI script on the target web server that typically provides large responses to trigger a memory leak.
The flaw resides in
'modules/http/http_protocol.c'.
|
Impact: A remote user can consume excessive memory on the target system.
|
Solution: HP has issued a fix for Apache on HP-UX (Apache v.2.0.55.00 or subsequent), available at:
http://h20293.www2.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl
?productNumber=HPUXWSSUITE
The vendor's advisory is available at:
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00555254
|
Vendor URL: httpd.apache.org/ (Links to External Site)
|
Cause: Resource error, State error
|
Underlying OS: UNIX (HP/UX)
|
Underlying OS Comments: HP-UX B.11.00, B.11.04, B.11.11, B.11.23
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 16 Nov 2005 01:41:32 -0500
Subject: HPSBUX02074 SSRT051251 - Apache-based Web Server on HP-UX mod_ssl, proxy_http, Remote Execution of Arbitrary Code, Denial of Service (DoS), and U
|
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00555254
CVE-2005-2491, CVE-2005-1268, CVE-2005-2728, CVE-2005-2088
|
|
