(Oracle Issues Fix for Solaris) Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1025473

SecurityTracker URL: http://securitytracker.com/id/1025473

CVE Reference: CVE-2010-0408 (Links to External Site)

Date: May 2 2011

Impact: Denial of service via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 2.2.x prior to 2.2.15

Description: A vulnerability was reported in Apache. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to trigger a flaw in the ap_proxy_ajp_request() function and cause the target backend server to enter and remain in an error state until the retry timeout has expired.

Niku Toivola of Sulake Corporation reported this vulnerability.

Impact: A remote user can cause the target server to enter an error state.

Solution: Oracle has issued a fix for Solaris.

The Oracle advisory is available at:

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_the_apache

Vendor URL: httpd.apache.org/ (Links to External Site)

Cause: State error

Underlying OS: UNIX (Solaris - SunOS)

Message History: This archive entry is a follow-up to the message listed below.


[Original Message Not Available for Viewing]