Bug 509375 (CVE-2009-1890) - CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)
Summary: CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-1890
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 505026 505027 509781 509782 509783
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-07-02 14:15 UTC by Tomas Hoger
Modified: 2019-09-29 12:30 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-24 16:03:22 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1148 0 normal SHIPPED_LIVE Important: httpd security update 2009-07-09 16:10:16 UTC
Red Hat Product Errata RHSA-2009:1155 0 normal SHIPPED_LIVE Important: httpd security update 2009-07-14 19:07:00 UTC
Red Hat Product Errata RHSA-2009:1156 0 normal SHIPPED_LIVE Important: httpd security update 2009-07-14 19:07:55 UTC
Red Hat Product Errata RHSA-2009:1160 0 normal SHIPPED_LIVE Important: httpd22 security update 2009-07-17 13:13:34 UTC

Description Tomas Hoger 2009-07-02 14:15:12 UTC 
A DoS flaw was fixed in httpd's mod_proxy.  Problem affects httpd 2.2.x+ and mod_proxy in reverse proxy setups.

Upstream commit:

  http://svn.apache.org/viewvc?view=rev&revision=790587

     Fix a potential Denial-of-Service attack against mod_proxy in a
     reverse proxy configuration, where a remote attacker can force a
     proxy process to consume CPU time indefinitely.

Upstream test case:

  http://svn.apache.org/viewvc?view=rev&revision=790589
Comment 2 Vincent Danen 2009-07-06 21:07:35 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1890 to
the following vulnerability:

Name: CVE-2009-1890
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890
Assigned: 20090602
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587
Reference: CONFIRM: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587
Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&revision=790587
Reference: SECUNIA:35691
Reference: URL: http://secunia.com/advisories/35691

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy
module in the Apache HTTP Server before 2.3.3, when a reverse proxy is
configured, does not properly handle an amount of streamed data that
exceeds the Content-Length value, which allows remote attackers to
cause a denial of service (CPU consumption) via crafted requests.
Comment 5 errata-xmlrpc 2009-07-09 16:10:19 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1148 https://rhn.redhat.com/errata/RHSA-2009-1148.html
Comment 6 errata-xmlrpc 2009-07-14 19:07:03 UTC 
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 5

Via RHSA-2009:1155 https://rhn.redhat.com/errata/RHSA-2009-1155.html
Comment 7 errata-xmlrpc 2009-07-14 19:07:57 UTC 
This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1156 https://rhn.redhat.com/errata/RHSA-2009-1156.html
Comment 8 errata-xmlrpc 2009-07-17 13:13:37 UTC 
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4

Via RHSA-2009:1160 https://rhn.redhat.com/errata/RHSA-2009-1160.html
Comment 9 Fedora Update System 2009-08-31 23:39:03 UTC 
httpd-2.2.13-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.