Multiple vulnerabilities in Apache HTTP Server

Description

Multiple serious vulnerabilities have been found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to cause a denial of service.

Below is a complete list of vulnerabilities

1. Stack recursion crash in the mod_lua module in the lua_request.c file in lua_websocket_read function can lead to cause a denial of service via specially crafted PING request.
2. The read_request_line function in server/protocol.c file doesn’t properly initialize the protocol structure member which can lead to cause a denial of service via specially crafted request.
3. The chunked transfer coding implementation parse chunk headers improperly which can lead to HTTP Request Smuggling Attack via a specially crafted request
4. The ap_some_auth_required function in server/request.c file has design error which renders the API unusuable.

Original advisories

• Apache changelog

Related products

• Apache-HTTP-Server

CVE list

• CVE-2015-0228
  critical
• CVE-2015-0253
  critical
• CVE-2015-3183
  critical
• CVE-2015-3185
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com