CVE-2011-1928 The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infin...
MediumCVSS 4.3
EPSS 10.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache apr-util | = 1.4.3 | No fix listed |
| apache apr-util | = 1.4.4 | No fix listed |
| Apache HTTP Server | = 2.2.18 | No fix listed |
| debian/apr(Debian:12) | < 1.4.5-1 | 1.4.5-1 |
| debian/apr(Debian:13) | < 1.4.5-1 | 1.4.5-1 |
| debian/apr(Debian:14) | < 1.4.5-1 | 1.4.5-1 |
References
- bugs.debian.org
- SUSE-SU-2011:1229 vendor-advisory
- [httpd-announce] 20110519 Regressions in httpd 2.2.18, apr 1.4.4, and apr-util 1.3.11 mailing-list
- [www-announce] 20110519 Regressions in httpd 2.2.18, apr 1.4.4, and apr-util 1.3.11 mailing-list
- SSRT100966 vendor-advisory
- [oss-security] 20110519 Re: CVE request: DoS in apr due to CVE-2011-0419 fix mailing-list
- [oss-security] 20110519 CVE request: DoS in apr due to CVE-2011-0419 fix mailing-list
- 44558 third-party-advisory vendor-advisory
- 44613 third-party-advisory
- 44661 third-party-advisory vendor-advisory
- 44780 third-party-advisory
- 48308 third-party-advisory
- MDVSA-2011:095 vendor-advisory
- RHSA-2011:0844 vendor-advisory
- ADV-2011-1289 vdb-entry vendor-advisory
- ADV-2011-1290 vdb-entry vendor-advisory
- issues.apache.org
- Debian Security Tracker CVE-2011-1928 vendor-advisory
- bugs.debian.org issue-tracking