(Sun Issues Fix) Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1011209 |
|
SecurityTracker URL: http://securitytracker.com/id/1011209
|
|
CVE Reference:
CAN-2004-0174
(Links to External Site)
|
Date: Sep 10 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.0.48 and prior versions; 1.3.29 and prior versions
|
Description:
A vulnerability was reported in the Apache web server. A remote user may be able to cause denial of service conditions.
It is reported that a remote user can establish a short-lived connection to a rarely-accessed listening socket on the target server. This may cause the Apache child process to block new connections until another connection arrives on the rarely-accessed listening socket.
The report indicates that some versions of AIX, Solaris, and Tru64 UNIX are affected, but that FreeBSD and Linux systems are not affected.
|
Impact:
A remote user may be able to cause the target server to deny connection requests.
|
Solution:
Sun has issued the following patches for Apache:
SPARC Platform
* Solaris 9 with patch 113146-05 or later
x86 Platform
* Solaris 9 with patch 114145-04 or later
A final resolution is pending for Solaris 8.
|
Vendor URL: httpd.apache.org/ (Links to External Site)
|
Cause:
Resource error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 10 Sep 2004 02:11:18 -0400
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1
|
Sun has issued the following patches for Apache:
SPARC Platform
* Solaris 9 with patch 113146-05 or later
x86 Platform
* Solaris 9 with patch 114145-04 or later
A final resolution is pending for Solaris 8.
These patches address:
CAN-2003-0987: "mod_digest issue"
CAN-2003-0020: "filtering of data sent to errorlog"
CAN-2004-0174: "possible denial of service"
CAN-2003-0993: "mod_access on 64-bit platforms"
CAN-2004-0492: "buffer overflow in mod_proxy"
-----
# Sun Alert ID: 57628
# Synopsis: Security Vulnerabilities in the Apache Web Server and Apache Modules
# Category: Security
# Product: Solaris
# BugIDs: 5048900, 5069902
# Avoidance: Patch
# State: Committed
# Date Released: 24-Aug-2004
# Date Closed:
# Date Modified: 09-Sep-2004
|
|
