Bug 1120596 – CVE-2014-0231 httpd: mod_cgid denial of service

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1120596 - (CVE-2014-0231) CVE-2014-0231 httpd: mod_cgid denial of service

Summary:	CVE-2014-0231 httpd: mod_cgid denial of service

Status:	CLOSED ERRATA

Aliases:	CVE-2014-0231

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140717,repor...
Keywords:	Security

Depends On:	1120605 1120606 1120607 1120608 1120612 1120613 1120614 1120935 1120936 1120937 1120938 1120939 1120940 1121037 1121038
Blocks:	1064757 1116304 1120610 1120623
	Show dependency tree / graph

Reported:	2014-07-17 05:06 EDT by Murray McAllister
Modified:	2015-07-29 17:39 EDT (History)
CC List:	39 users (show)

See Also:
Fixed In Version:	httpd 2.4.10
Doc Type:	Bug Fix
Doc Text:	A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-07-09 22:47:21 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0920	normal	SHIPPED_LIVE	Important: httpd security update	2014-07-23 09:19:05 EDT
Red Hat Product Errata	RHSA-2014:0921	normal	SHIPPED_LIVE	Important: httpd security update	2014-07-23 10:00:19 EDT
Red Hat Product Errata	RHSA-2014:0922	normal	SHIPPED_LIVE	Important: httpd24-httpd security update	2014-07-23 10:00:09 EDT
Red Hat Product Errata	RHSA-2014:1019	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update	2014-08-06 15:06:42 EDT
Red Hat Product Errata	RHSA-2014:1020	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update	2014-08-06 15:03:06 EDT
Red Hat Product Errata	RHSA-2014:1021	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update	2014-08-06 14:52:25 EDT
Red Hat Product Errata	RHSA-2014:1086	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:30:27 EDT
Red Hat Product Errata	RHSA-2014:1087	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:29:44 EDT
Red Hat Product Errata	RHSA-2014:1088	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:29:14 EDT

Groups: None (edit)

Description Murray McAllister 2014-07-17 05:06:08 EDT

The following flaw has been fixed in the Apache HTTP Server:

"A flaw was found in mod_cgid. If a server using mod_cgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."

External References:

http://httpd.apache.org/security/vulnerabilities_24.html

Comment 2 Murray McAllister 2014-07-17 05:39:07 EDT

Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1120614]

Comment 9 Tomas Hoger 2014-07-23 02:53:20 EDT

Upstream commits:
http://svn.apache.org/viewvc?view=revision&revision=1535125
http://svn.apache.org/viewvc?view=revision&revision=1610509

2.4 backport:
http://svn.apache.org/viewvc?view=revision&revision=1610512

Comment 10 errata-xmlrpc 2014-07-23 05:19:25 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2014:0920 https://rhn.redhat.com/errata/RHSA-2014-0920.html

Comment 11 errata-xmlrpc 2014-07-23 06:00:44 EDT

This issue has been addressed in following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:0922 https://rhn.redhat.com/errata/RHSA-2014-0922.html

Comment 12 errata-xmlrpc 2014-07-23 06:01:31 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0921 https://rhn.redhat.com/errata/RHSA-2014-0921.html

Comment 13 Jakub Cechacek 2014-07-23 07:20:17 EDT

@Andrew
As I am working on this verification only as kind of a backup, would you mind being more specific about how to determine the status of httpd child processes?

Comment 16 Fedora Update System 2014-07-25 06:03:31 EDT

httpd-2.4.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Martin Prpič 2014-07-28 07:28:28 EDT

IssueDescription:

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.

Comment 18 errata-xmlrpc 2014-08-06 10:53:30 EDT

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.3.0

Via RHSA-2014:1021 https://rhn.redhat.com/errata/RHSA-2014-1021.html

Comment 19 errata-xmlrpc 2014-08-06 11:09:21 EDT

This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2014:1020 https://rhn.redhat.com/errata/RHSA-2014-1020.html

Comment 20 errata-xmlrpc 2014-08-06 11:11:36 EDT

This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2014:1019 https://rhn.redhat.com/errata/RHSA-2014-1019.html

Comment 21 Fedora Update System 2014-08-14 22:46:56 EDT

httpd-2.4.10-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 22 errata-xmlrpc 2014-08-21 11:31:40 EDT

This issue has been addressed in following products:

  JBEWS 2 for RHEL 5

Via RHSA-2014:1088 https://rhn.redhat.com/errata/RHSA-2014-1088.html

Comment 23 errata-xmlrpc 2014-08-21 11:32:08 EDT

This issue has been addressed in following products:

  JBEWS 2 for RHEL 6

Via RHSA-2014:1087 https://rhn.redhat.com/errata/RHSA-2014-1087.html

Comment 24 errata-xmlrpc 2014-08-21 11:32:43 EDT

This issue has been addressed in following products:

  JBoss Web Server 2.1.0

Via RHSA-2014:1086 https://rhn.redhat.com/errata/RHSA-2014-1086.html

Note You need to log in before you can comment on or make changes to this bug.

anmiller
bdunne
bressers
cdewolf
chazlett
dajohnso
dandread
darran.lofthouse
dclarizi
dknox
fnasser
gmccullo
grocha
huwang
jason.greene
jawilson
jclere
jdoyle
jfrey
jkaluza
jkudrnac
jorton
jprause
jrafanie
jvlcek
kseifried
lgao
mmaslano
myarboro
obarenbo
pahan
pgier
pslavice
rmeggins
rsvoboda
vtunka
webstack-team
weli
xlecauch