CVE-2007-1863 cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (...
MediumCVSS 5.0
EPSS 11.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple mac os x server | = 10.0 | No fix listed |
| apple mac os x server | = 10.1 | No fix listed |
| apple mac os x server | = 10.1.1 | No fix listed |
| apple mac os x server | = 10.1.2 | No fix listed |
| apple mac os x server | = 10.1.3 | No fix listed |
| apple mac os x server | = 10.1.4 | No fix listed |
| apple mac os x server | = 10.1.5 | No fix listed |
| apple mac os x server | = 10.2 | No fix listed |
| apple mac os x server | = 10.2.1 | No fix listed |
| apple mac os x server | = 10.2.2 | No fix listed |
| apple mac os x server | = 10.2.3 | No fix listed |
| apple mac os x server | = 10.2.4 | No fix listed |
| apple mac os x server | = 10.2.5 | No fix listed |
| apple mac os x server | = 10.2.6 | No fix listed |
| apple mac os x server | = 10.2.7 | No fix listed |
| apple mac os x server | = 10.2.8 | No fix listed |
| apple mac os x server | = 10.3 | No fix listed |
| apple mac os x server | = 10.3.1 | No fix listed |
| apple mac os x server | = 10.3.2 | No fix listed |
| apple mac os x server | = 10.3.3 | No fix listed |
| apple mac os x server | = 10.3.4 | No fix listed |
| apple mac os x server | = 10.3.5 | No fix listed |
| apple mac os x server | = 10.3.6 | No fix listed |
| apple mac os x server | = 10.3.7 | No fix listed |
| apple mac os x server | = 10.3.8 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apple mac os x server | = 10.3.9 | No fix listed |
| apple mac os x server | = 10.4 | No fix listed |
| apple mac os x server | = 10.4.1 | No fix listed |
| apple mac os x server | = 10.4.2 | No fix listed |
| apple mac os x server | = 10.4.3 | No fix listed |
| apple mac os x server | = 10.4.4 | No fix listed |
| apple mac os x server | = 10.4.5 | No fix listed |
| apple mac os x server | = 10.4.6 | No fix listed |
| apple mac os x server | = 10.4.7 | No fix listed |
| apple mac os x server | = 10.4.8 | No fix listed |
| apple mac os x server | = 10.4.9 | No fix listed |
| Apache HTTP Server | >= 2.0.37, < 2.0.61 | 2.0.61 |
| Apache HTTP Server | >= 2.2.0, < 2.2.6 | 2.2.6 |
| debian/apache2(Debian:12) | < 2.2.4-1 | 2.2.4-1 |
| debian/apache2(Debian:13) | < 2.2.4-1 | 2.2.4-1 |
| debian/apache2(Debian:14) | < 2.2.4-1 | 2.2.4-1 |
References
- bugs.gentoo.org third-party-advisory
- bugzilla.redhat.com issue-tracking
- SSRT071447 broken-link vendor-advisory
- httpd.apache.org vendor-advisory
- httpd.apache.org vendor-advisory
- APPLE-SA-2008-05-28 third-party-advisory vendor-advisory
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list third-party-advisory vdb-entry
- 37079 broken-link vdb-entry
- RHSA-2007:0534 third-party-advisory vendor-advisory
- RHSA-2007:0556 third-party-advisory vdb-entry vendor-advisory
- 25830 broken-link third-party-advisory
- 25873 broken-link third-party-advisory
- 25920 broken-link third-party-advisory
- 26273 broken-link third-party-advisory
- 26443 broken-link third-party-advisory
- 26508 broken-link third-party-advisory
- 26822 broken-link third-party-advisory
- 26842 broken-link third-party-advisory
- 26993 broken-link third-party-advisory
- 27037 broken-link third-party-advisory
- 27563 broken-link third-party-advisory
- 27732 broken-link third-party-advisory
- 28606 broken-link third-party-advisory
- 30430 broken-link third-party-advisory
- GLSA-200711-06 third-party-advisory vendor-advisory
- support.avaya.com third-party-advisory
- svn.apache.org third-party-advisory
- PK49355 third-party-advisory vendor-advisory
- PK52702 third-party-advisory vendor-advisory
- www.fujitsu.com third-party-advisory
- MDKSA-2007:140 third-party-advisory vendor-advisory
- MDKSA-2007:141 third-party-advisory vendor-advisory
- SUSE-SA:2007:061 broken-link vendor-advisory
- FEDORA-2007-2214 mailing-list third-party-advisory vendor-advisory
- RHSA-2007:0557 broken-link vendor-advisory
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list third-party-advisory vdb-entry
- 24649 third-party-advisory vdb-entry
- 1018303 third-party-advisory vdb-entry
- 2007-0026 broken-link vendor-advisory
- USN-499-1 third-party-advisory vdb-entry vendor-advisory
- TA08-150A broken-link third-party-advisory
- ADV-2007-2727 permissions-required third-party-advisory vdb-entry
- ADV-2007-3283 permissions-required third-party-advisory vdb-entry
- ADV-2007-3386 permissions-required third-party-advisory vdb-entry
- ADV-2008-0233 permissions-required third-party-advisory vdb-entry
- ADV-2008-1697 permissions-required third-party-advisory vdb-entry
- issues.rpath.com broken-link
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210422 svn commit: r1074079 [2/3] - in /websites/staging/httpd/trunk/content: ./ apreq/ contribute/ contributors/ dev/ docs-project/ docs/ info/ mod_fcgid/ mod_ftp/ mod_mbox/ mod_smtpd/ modules/ security/ test/ test/flood/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- oval:org.mitre.oval:def:9824 broken-link signature vdb-entry
- RHSA-2007:0533 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2007-1863 vendor-advisory