Bug 509375 – CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 509375 - (CVE-2009-1890) CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)

Summary:	CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)

Status:	CLOSED ERRATA

Aliases:	CVE-2009-1890

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,source=upstream,repo...
Keywords:	Security

Depends On:	505026 505027 509781 509782 509783
Blocks:
	Show dependency tree / graph

Reported:	2009-07-02 10:15 EDT by Tomas Hoger
Modified:	2016-03-04 06:54 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-08-24 12:03:22 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2009:1148	normal	SHIPPED_LIVE	Important: httpd security update	2009-07-09 12:10:16 EDT
Red Hat Product Errata	RHSA-2009:1155	normal	SHIPPED_LIVE	Important: httpd security update	2009-07-14 15:07:00 EDT
Red Hat Product Errata	RHSA-2009:1156	normal	SHIPPED_LIVE	Important: httpd security update	2009-07-14 15:07:55 EDT
Red Hat Product Errata	RHSA-2009:1160	normal	SHIPPED_LIVE	Important: httpd22 security update	2009-07-17 09:13:34 EDT

Groups: None (edit)

Description Tomas Hoger 2009-07-02 10:15:12 EDT

A DoS flaw was fixed in httpd's mod_proxy.  Problem affects httpd 2.2.x+ and mod_proxy in reverse proxy setups.

Upstream commit:

  http://svn.apache.org/viewvc?view=rev&revision=790587

     Fix a potential Denial-of-Service attack against mod_proxy in a
     reverse proxy configuration, where a remote attacker can force a
     proxy process to consume CPU time indefinitely.

Upstream test case:

  http://svn.apache.org/viewvc?view=rev&revision=790589

Comment 2 Vincent Danen 2009-07-06 17:07:35 EDT

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1890 to
the following vulnerability:

Name: CVE-2009-1890
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890
Assigned: 20090602
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587
Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&revision=790587
Reference: SECUNIA:35691
Reference: URL: http://secunia.com/advisories/35691

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy
module in the Apache HTTP Server before 2.3.3, when a reverse proxy is
configured, does not properly handle an amount of streamed data that
exceeds the Content-Length value, which allows remote attackers to
cause a denial of service (CPU consumption) via crafted requests.

Comment 5 errata-xmlrpc 2009-07-09 12:10:19 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1148 https://rhn.redhat.com/errata/RHSA-2009-1148.html

Comment 6 errata-xmlrpc 2009-07-14 15:07:03 EDT

This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 5

Via RHSA-2009:1155 https://rhn.redhat.com/errata/RHSA-2009-1155.html

Comment 7 errata-xmlrpc 2009-07-14 15:07:57 EDT

This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1156 https://rhn.redhat.com/errata/RHSA-2009-1156.html

Comment 8 errata-xmlrpc 2009-07-17 09:13:37 EDT

This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4

Via RHSA-2009:1160 https://rhn.redhat.com/errata/RHSA-2009-1160.html

Comment 9 Fedora Update System 2009-08-31 19:39:03 EDT

httpd-2.2.13-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.