Bug 1149709 (CVE-2014-3581) - CVE-2014-3581 httpd: NULL pointer dereference in mod_cache if Content-Type has empty value
Summary: CVE-2014-3581 httpd: NULL pointer dereference in mod_cache if Content-Type ha...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3581
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1149712 1166709 1167817 1265996
Blocks: 1149710
TreeView+ depends on / blocked
 
Reported: 2014-10-06 13:54 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 06:08 UTC (History)
48 users (show)

Fixed In Version: httpd 2.4.11
Doc Type: Bug Fix
Doc Text:
A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled.
Clone Of:
Environment:
Last Closed: 2015-03-06 10:42:20 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1972 0 normal SHIPPED_LIVE Low: httpd24-httpd security and bug fix update 2014-12-09 23:07:45 UTC
Red Hat Product Errata RHSA-2015:0325 0 normal SHIPPED_LIVE Low: httpd security, bug fix, and enhancement update 2015-03-05 11:59:16 UTC

Description Vasyl Kaigorodov 2014-10-06 13:54:10 UTC 
It was reported that if Content-Type header value is empty, httpd with mod_cache enabled will segfault:
https://issues.apache.org/bugzilla/show_bug.cgi?id=56924

Upstream patch:
http://svn.apache.org/viewvc?view=revision&revision=1624234
Comment 1 Vasyl Kaigorodov 2014-10-06 13:58:52 UTC 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1149712]
Comment 4 Vasyl Kaigorodov 2014-10-21 14:41:46 UTC 
Per https://issues.apache.org/bugzilla/show_bug.cgi?id=56924#c6 httpd 2.2.x is not affected.
Comment 5 Vasyl Kaigorodov 2014-10-21 14:42:11 UTC 
Statement:

This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5 and 6, JBoss Enterprise Web Server 1 and 2, and JBoss Application Platform 6.
Comment 7 Tomas Hoger 2014-11-21 20:31:23 UTC 
This issue is a NULL pointer dereference flaw, triggered by a Content-Type HTTP header with no value.  It causes an httpd child process to crash.  A new child process is spawned after the crash.  The crash may impact other concurrent connection served by the same child process when using threaded MPM.  It can be triggered locally if e.g. CGI script can generate such malformed header under some circumstances, or when caching is used in combination with proxying to different HTTP server.
Comment 8 Tomas Hoger 2014-11-21 20:34:05 UTC 
The issue is currently fixed in development code expected to be released as version 2.4.11.  Upstream bug also notes that httpd versions 2.2 (and earlier) were not affected by this issue, as the ap_make_content_type() function never returns NULL in those versions.  Therefore, the httpd packages in Red Hat Enterprise Linux 6 and earlier were not affected by this issue.  The httpd packages based on httpd 2.4 are currently only available as part of Red Hat Enterprise Linux 7 and Red Hat Software Collections 1.
Comment 12 Martin Prpič 2014-11-26 10:59:25 UTC 
IssueDescription:

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled.
Comment 13 errata-xmlrpc 2014-12-09 18:08:30 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:1972 https://rhn.redhat.com/errata/RHSA-2014-1972.html
Comment 14 Fedora Update System 2015-02-28 10:22:44 UTC 
httpd-2.4.10-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 errata-xmlrpc 2015-03-05 07:13:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0325 https://rhn.redhat.com/errata/RHSA-2015-0325.html
Comment 16 Fedora Update System 2015-03-16 01:41:32 UTC 
httpd-2.4.10-15.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.