Bug 1120603 (CVE-2014-0226)

Summary:	CVE-2014-0226 httpd: mod_status heap-based buffer overflow
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anmiller, bdunne, bressers, carnil, cdewolf, chazlett, csutherl, dajohnso, dandread, darran.lofthouse, dclarizi, dknox, fnasser, gmccullo, grocha, huwang, jason.greene, jawilson, jclere, jdoyle, jfrey, jkaluza, jorton, jprause, jrafanie, jrusnack, jvlcek, kseifried, lgao, mbabacek, mmaslano, mmiura, myarboro, obarenbo, pahan, pgier, pslavice, rmeggins, rsvoboda, sardella, vtunka, webstack-team, weli, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	httpd 2.4.10	Doc Type:	Bug Fix
Doc Text:	A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-10 02:46:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1120605, 1120606, 1120607, 1120608, 1120612, 1120613, 1120614, 1120935, 1120936, 1120937, 1120938, 1120939, 1120940, 1121037, 1121038
Bug Blocks:	1064757, 1116304, 1120610, 1120623

Description Murray McAllister 2014-07-17 09:15:45 UTC

The following flaw has been fixed in the Apache HTTP Server:

"A race condition was found in mod_status. An attacker able to access a public server status page on a server using a threaded MPM could send a carefully crafted request which could lead to a heap buffer overflow. Note that it is not a default or recommended configuration to have a public accessible server status page."

External References:

http://httpd.apache.org/security/vulnerabilities_24.html

Comment 3 Murray McAllister 2014-07-17 09:41:03 UTC

Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1120614]

Comment 9 Tomas Hoger 2014-07-23 06:49:27 UTC

Upstream commit:
http://svn.apache.org/viewvc?view=revision&revision=1610491

Comment 10 errata-xmlrpc 2014-07-23 09:19:34 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2014:0920 https://rhn.redhat.com/errata/RHSA-2014-0920.html

Comment 11 errata-xmlrpc 2014-07-23 10:00:59 UTC

This issue has been addressed in following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:0922 https://rhn.redhat.com/errata/RHSA-2014-0922.html

Comment 12 errata-xmlrpc 2014-07-23 10:01:46 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0921 https://rhn.redhat.com/errata/RHSA-2014-0921.html

Comment 13 Fedora Update System 2014-07-25 10:03:44 UTC

httpd-2.4.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Martin Prpič 2014-07-28 11:28:37 UTC

IssueDescription:

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.

Comment 15 errata-xmlrpc 2014-08-06 14:53:42 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.3.0

Via RHSA-2014:1021 https://rhn.redhat.com/errata/RHSA-2014-1021.html

Comment 16 errata-xmlrpc 2014-08-06 15:09:28 UTC

This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2014:1020 https://rhn.redhat.com/errata/RHSA-2014-1020.html

Comment 17 errata-xmlrpc 2014-08-06 15:11:45 UTC

This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2014:1019 https://rhn.redhat.com/errata/RHSA-2014-1019.html

Comment 18 Fedora Update System 2014-08-15 02:47:12 UTC

httpd-2.4.10-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 19 errata-xmlrpc 2014-08-21 15:31:51 UTC

This issue has been addressed in following products:

  JBEWS 2 for RHEL 5

Via RHSA-2014:1088 https://rhn.redhat.com/errata/RHSA-2014-1088.html

Comment 20 errata-xmlrpc 2014-08-21 15:32:19 UTC

This issue has been addressed in following products:

  JBEWS 2 for RHEL 6

Via RHSA-2014:1087 https://rhn.redhat.com/errata/RHSA-2014-1087.html

Comment 21 errata-xmlrpc 2014-08-21 15:32:53 UTC

This issue has been addressed in following products:

  JBoss Web Server 2.1.0

Via RHSA-2014:1086 https://rhn.redhat.com/errata/RHSA-2014-1086.html