Multiple vulnerabilities in Apache HTTP Server

Beschreibung

Multiple serious vulnerabilities have been found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to cause a denial of service.

Below is a complete list of vulnerabilities

1. Stack recursion crash in the mod_lua module in the lua_request.c file in lua_websocket_read function can lead to cause a denial of service via specially crafted PING request.
2. The read_request_line function in server/protocol.c file doesn’t properly initialize the protocol structure member which can lead to cause a denial of service via specially crafted request.
3. The chunked transfer coding implementation parse chunk headers improperly which can lead to HTTP Request Smuggling Attack via a specially crafted request
4. The ap_some_auth_required function in server/request.c file has design error which renders the API unusuable.

Ursprüngliche Informationshinweise

• Apache changelog

CVE Liste

• CVE-2015-0228
  warning
• CVE-2015-0253
  warning
• CVE-2015-3183
  warning
• CVE-2015-3185
  warning

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com