Red Hat Bugzilla – Bug 1149709
CVE-2014-3581 httpd: NULL pointer dereference in mod_cache if Content-Type has empty value
Last modified: 2016-01-12 12:55:34 EST
It was reported that if Content-Type header value is empty, httpd with mod_cache enabled will segfault: https://issues.apache.org/bugzilla/show_bug.cgi?id=56924 Upstream patch: http://svn.apache.org/viewvc?view=revision&revision=1624234
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 1149712]
Per https://issues.apache.org/bugzilla/show_bug.cgi?id=56924#c6 httpd 2.2.x is not affected.
Statement: This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5 and 6, JBoss Enterprise Web Server 1 and 2, and JBoss Application Platform 6.
This issue is a NULL pointer dereference flaw, triggered by a Content-Type HTTP header with no value. It causes an httpd child process to crash. A new child process is spawned after the crash. The crash may impact other concurrent connection served by the same child process when using threaded MPM. It can be triggered locally if e.g. CGI script can generate such malformed header under some circumstances, or when caching is used in combination with proxying to different HTTP server.
The issue is currently fixed in development code expected to be released as version 2.4.11. Upstream bug also notes that httpd versions 2.2 (and earlier) were not affected by this issue, as the ap_make_content_type() function never returns NULL in those versions. Therefore, the httpd packages in Red Hat Enterprise Linux 6 and earlier were not affected by this issue. The httpd packages based on httpd 2.4 are currently only available as part of Red Hat Enterprise Linux 7 and Red Hat Software Collections 1.
IssueDescription: A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled.
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Via RHSA-2014:1972 https://rhn.redhat.com/errata/RHSA-2014-1972.html
httpd-2.4.10-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:0325 https://rhn.redhat.com/errata/RHSA-2015-0325.html
httpd-2.4.10-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.