CVE-2009-1890

Severity

71%

Complexity

86%

Confidentiality

115%

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

CVSS 2.0 Base Score 7.1. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C).

Overview

Type

Apache Software Foundation

First reported 15 years ago

2009-07-05 16:30:00

Last updated 6 years ago

2018-10-30 16:25:00

Affected Software

Apache Software Foundation Apache HTTP Server

Apache Software Foundation Apache HTTP Server 0.8.11

0.8.11

Apache Software Foundation Apache HTTP Server 0.8.14

0.8.14

Apache Software Foundation Apache HTTP Server 1.0

1.0

Apache Software Foundation Apache HTTP Server 1.0.2

1.0.2

Apache Software Foundation Apache HTTP Server 1.0.3

1.0.3

Apache Software Foundation Apache HTTP Server 1.0.5

1.0.5

Apache Software Foundation Apache HTTP Server 1.1

1.1

Apache Software Foundation Apache HTTP Server 1.1.1

1.1.1

Apache Software Foundation Apache 1.2

1.2

Apache Software Foundation Apache HTTP Server 1.2.4

1.2.4

Apache Software Foundation Apache HTTP Server 1.2.5

1.2.5

Apache Software Foundation Apache HTTP Server 1.2.6

1.2.6

Apache Software Foundation Apache 1.29

1.2.9

Apache Software Foundation Apache HTTP Server 1.3

1.3

Apache Software Foundation Apache HTTP Server 1.3.0

1.3.0

Apache Software Foundation Apache HTTP Server 1.3.1

1.3.1

Apache Software Foundation Apache HTTP Server 1.3.1.1

1.3.1.1

Apache Software Foundation Apache HTTP Server 1.3.2

1.3.2

Apache Software Foundation Apache HTTP Server 1.3.3

1.3.3

Apache Software Foundation Apache HTTP Server 1.3.4

1.3.4

Apache Software Foundation Apache HTTP Server 1.3.5

1.3.5

Apache Software Foundation Apache HTTP Server 1.3.6

1.3.6

Apache Software Foundation Apache HTTP Server 1.3.7

1.3.7

Apache Software Foundation Apache HTTP Server 1.3.8

1.3.8

Apache Software Foundation Apache HTTP Server 1.3.9

1.3.9

Apache Software Foundation Apache 1.3.10

1.3.10

Apache Software Foundation Apache HTTP Server 1.3.11

1.3.11

Apache Software Foundation Apache HTTP Server 1.3.12

1.3.12

Apache Software Foundation Apache 1.3.13

1.3.13

Apache Software Foundation Apache HTTP Server 1.3.14

1.3.14

Apache Software Foundation Apache 1.3.15

1.3.15

Apache Software Foundation Apache 1.3.16

1.3.16

Apache Software Foundation Apache HTTP Server 1.3.17

1.3.17

Apache Software Foundation Apache HTTP Server 1.3.18

1.3.18

Apache Software Foundation Apache HTTP Server 1.3.19

1.3.19

Apache Software Foundation Apache HTTP Server 1.3.20

1.3.20

Apache Software Foundation Apache HTTP Server 1.3.22

1.3.22

Apache Software Foundation Apache HTTP Server 1.3.23

1.3.23

Apache Software Foundation Apache HTTP Server 1.3.24

1.3.24

Apache Software Foundation Apache HTTP Server 1.3.25

1.3.25

Apache Software Foundation Apache HTTP Server 1.3.26

1.3.26

Apache Software Foundation Apache HTTP Server 1.3.27

1.3.27

Apache Software Foundation Apache HTTP Server 1.3.28

1.3.28

Apache Software Foundation Apache HTTP Server 1.3.29

1.3.29

Apache Software Foundation Apache HTTP Server 1.3.30

1.3.30

Apache Software Foundation Apache HTTP Server 1.3.31

1.3.31

Apache Software Foundation Apache HTTP Server 1.3.32

1.3.32

Apache Software Foundation Apache HTTP Server 1.3.33

1.3.33

Apache Software Foundation Apache HTTP Server 1.3.34

1.3.34

Apache Software Foundation Apache HTTP Server 1.3.35

1.3.35

Apache Software Foundation Apache HTTP Server 1.3.36

1.3.36

Apache Software Foundation Apache HTTP Server 1.3.37

1.3.37

Apache Software Foundation Apache HTTP Server 1.3.38

1.3.38

Apache Software Foundation Apache HTTP Server 1.3.39

1.3.39

Apache Software Foundation Apache HTTP Server 1.3.65

1.3.65

Apache Software Foundation Apache HTTP Server 1.3.68

1.3.68

Apache Software Foundation Apache HTTP Server 1.4.0

1.4.0

Apache Software Foundation Apache HTTP Server 1.99

1.99

Apache Software Foundation Apache HTTP Server 2.0

2.0

Apache Software Foundation Apache HTTP Server 2.0.9a

2.0.9

Apache Software Foundation Apache HTTP Server 2.0.28

2.0.28

Apache Software Foundation Apache HTTP Server 2.0.28 Beta

2.0.28

Apache Software Foundation Apache HTTP Server 2.0.32

2.0.32

Apache Software Foundation Apache HTTP Server 2.0.32 Beta

2.0.32

Apache Software Foundation Apache HTTP Server 2.0.34 Beta

2.0.34

Apache Software Foundation Apache HTTP Server 2.0.35

2.0.35

Apache Software Foundation Apache HTTP Server 2.0.36

2.0.36

Apache Software Foundation Apache HTTP Server 2.0.37

2.0.37

Apache Software Foundation Apache HTTP Server 2.0.38

2.0.38

Apache Software Foundation Apache HTTP Server 2.0.39

2.0.39

Apache Software Foundation Apache HTTP Server 2.0.40

2.0.40

Apache Software Foundation Apache HTTP Server 2.0.41

2.0.41

Apache Software Foundation Apache HTTP Server 2.0.42

2.0.42

Apache Software Foundation Apache HTTP Server 2.0.43

2.0.43

Apache Software Foundation Apache HTTP Server 2.0.44

2.0.44

Apache Software Foundation Apache HTTP Server 2.0.45

2.0.45

Apache Software Foundation Apache HTTP Server 2.0.46

2.0.46

Apache Software Foundation Apache HTTP Server 2.0.47

2.0.47

Apache Software Foundation Apache HTTP Server 2.0.48

2.0.48

Apache Software Foundation Apache HTTP Server 2.0.49

2.0.49

Apache Software Foundation Apache HTTP Server 2.0.50

2.0.50

Apache Software Foundation Apache HTTP Server 2.0.51

2.0.51

Apache Software Foundation Apache HTTP Server 2.0.52

2.0.52

Apache Software Foundation Apache HTTP Server 2.0.53

2.0.53

Apache Software Foundation Apache HTTP Server 2.0.54

2.0.54

Apache Software Foundation Apache HTTP Server 2.0.55

2.0.55

Apache Software Foundation Apache HTTP Server 2.0.56

2.0.56

Apache Software Foundation Apache HTTP Server 2.0.57

2.0.57

Apache Software Foundation Apache HTTP Server 2.0.58

2.0.58

Apache Software Foundation HTTP Server 2.0.59

2.0.59

Apache Software Foundation Apache HTTP Server 2.0.60 dev

2.0.60

Apache Software Foundation HTTP Server 2.0.61

2.0.61

Apache Software Foundation Apache HTTP Server 2.1

2.1

Apache Software Foundation Apache HTTP Server 2.1.1

2.1.1

Apache Software Foundation Apache HTTP Server 2.1.2

2.1.2

Apache Software Foundation Apache HTTP Server 2.1.3

2.1.3

Apache Software Foundation Apache HTTP Server 2.1.4

2.1.4

Apache Software Foundation Apache HTTP Server 2.1.5

2.1.5

Apache Software Foundation Apache HTTP Server 2.1.6

2.1.6

Apache Software Foundation Apache HTTP Server 2.1.7

2.1.7

Apache Software Foundation Apache HTTP Server 2.1.8

2.1.8

Apache Software Foundation Apache HTTP Server 2.1.9

2.1.9

Apache Software Foundation Apache HTTP Server 2.2

2.2

Apache Software Foundation Apache HTTP Server 2.2.0

2.2.0

Apache Software Foundation Apache HTTP Server 2.2.1

2.2.1

Apache Software Foundation Apache HTTP Server 2.2.2

2.2.2

Apache Software Foundation Apache HTTP Server 2.2.3

2.2.3

Apache Software Foundation Apache HTTP Server 2.2.4

2.2.4

Apache Software Foundation Apache HTTP Server 2.2.6

2.2.6

Apache Software Foundation Apache HTTP Server 2.2.8

2.2.8

Apache Software Foundation Apache HTTP Server 2.2.9

2.2.9

Apache Software Foundation Apache HTTP Server 2.2.10

2.2.10

Apache Software Foundation Apache HTTP Server 2.2.11

2.2.11

Apache Software Foundation Apache HTTP Server 2.3.0

2.3.0

Apache Software Foundation Apache HTTP Server 2.3.1

2.3.1

References

APPLE-SA-2009-11-09-1

SUSE-SA:2009:050

HPSBUX02612

55553

35691

Vendor Advisory

35721

35793

35865

37152

Vendor Advisory

37221

Vendor Advisory

GLSA-200907-04

http://support.apple.com/kb/HT3937

http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587

Vendor Advisory

http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587

Vendor Advisory

http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587

Patch, Vendor Advisory

http://svn.apache.org/viewvc?view=rev&revision=790587

Vendor Advisory

http://wiki.rpath.com/Advisories:rPSA-2009-0142

DSA-1834

MDVSA-2009:149

MDVSA-2013:150

http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

RHSA-2009:1156

20091112 rPSA-2009-0142-1 httpd mod_ssl

20091113 rPSA-2009-0142-2 httpd mod_ssl

35565

1022509

USN-802-1

ADV-2009-3184

Vendor Advisory

PK91259

PK99480

[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

oval:org.mitre.oval:def:12330

oval:org.mitre.oval:def:8616

oval:org.mitre.oval:def:9403

RHSA-2009:1148

FEDORA-2009-8812

[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.