CVE-2011-0419 Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in l...
MediumCVSS 4.3
EPSS 30.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache portable runtime | < 1.4.3 | 1.4.3 |
| Apache HTTP Server | >= 2.0.0, <= 2.0.65 | No fix listed |
| Apache HTTP Server | >= 2.2.0, <= 2.2.18 | No fix listed |
| apple mac os x | = 10.6.0 | No fix listed |
| freebsd | All versions | No fix listed |
| Google Android | All versions | No fix listed |
| netbsd | = 5.1 | No fix listed |
| OpenBSD | = 4.8 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| SUSE linux enterprise server | = 10-sp3 | No fix listed |
| debian/apr(Debian:12) | < 1.4.4-1 | 1.4.4-1 |
| debian/apr(Debian:13) | < 1.4.4-1 | 1.4.4-1 |
| debian/apr(Debian:14) | < 1.4.4-1 | 1.4.4-1 |
References
- Debian Security Tracker CVE-2011-0419 vendor-advisory
- cvsweb.netbsd.org third-party-advisory
- cxib.net patch third-party-advisory
- cxib.net third-party-advisory
- httpd.apache.org vendor-advisory
- APPLE-SA-2011-10-12-3 broken-link vendor-advisory
- SUSE-SU-2011:1229 mailing-list third-party-advisory vendor-advisory
- HPSBUX02702 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBUX02707 issue-tracking mailing-list third-party-advisory vendor-advisory
- SSRT100619 issue-tracking mailing-list third-party-advisory vendor-advisory
- SSRT100966 issue-tracking mailing-list third-party-advisory vendor-advisory
- 44490 not-applicable third-party-advisory vendor-advisory
- 44564 not-applicable third-party-advisory vendor-advisory
- 44574 not-applicable third-party-advisory vendor-advisory
- 48308 not-applicable third-party-advisory
- 20110512 Multiple Vendors libc/fnmatch(3) DoS (incl apache) exploit third-party-advisory
- 8246 exploit third-party-advisory
- 1025527 broken-link third-party-advisory vdb-entry
- support.apple.com third-party-advisory
- svn.apache.org patch vendor-advisory
- svn.apache.org patch vendor-advisory
- svn.apache.org patch vendor-advisory
- www.apache.org patch vendor-advisory
- www.apache.org broken-link
- www.apache.org patch vendor-advisory
- DSA-2237 third-party-advisory vendor-advisory
- [dev] 20110510 Re: fnmatch rewrite in apr, apr 1.4.3 mailing-list third-party-advisory
- [dev] 20110510 Re: Apache Portable Runtime 1.4.4 [...] Released mailing-list third-party-advisory
- [dev] 20110511 Re: Apache Portable Runtime 1.4.4 [...] Released mailing-list third-party-advisory
- MDVSA-2011:084 broken-link vendor-advisory
- MDVSA-2013:150 broken-link vendor-advisory
- www.openbsd.org broken-link
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- RHSA-2011:0507 third-party-advisory vendor-advisory
- RHSA-2011:0896 third-party-advisory vendor-advisory
- RHSA-2011:0897 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1888222 - in /httpd/site/trunk/content/security/json: CVE-2010-2068.json CVE-2010-2791.json CVE-2011-0419.json CVE-2011-3368.json mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory vdb-entry
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- oval:org.mitre.oval:def:14638 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:14804 signature third-party-advisory vdb-entry