CVE-2014-0226

Published Jul 20, 2014

Last updated a year ago

Overview

Description: Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-362

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E3EB5B9F-5ED4-411A-81BF-80EC785BA718",
            "versionEndExcluding": "2.2.29",
            "versionStartIncluding": "2.2.0"
          },
          {
            "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "58662204-56C2-495F-A833-3D618F8AE199",
            "versionEndExcluding": "2.4.10",
            "versionStartIncluding": "2.4.1"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D"
          },
          {
            "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B1ABA871-3271-48E2-A69C-5AD70AF94E53"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:11.1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AE885A2E-041B-4E9E-A5A9-13EBD45061FD"
          },
          {
            "criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BA2CF507-AA3F-464C-88DF-71E30672E623"
          },
          {
            "criteria": "cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2E69311-C5B8-45FA-809F-ADAE4E35559D"
          },
          {
            "criteria": "cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "911FBD5E-213D-482F-81A9-C3B8CE7D903A"
          },
          {
            "criteria": "cpe:2.3:a:oracle:http_server:12.1.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DACC1F65-5AF7-4CD4-ACD2-46D941A19110"
          },
          {
            "criteria": "cpe:2.3:a:oracle:http_server:12.1.3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DD4552F9-F5B9-4A52-BA5C-D32D49FABD28"
          },
          {
            "criteria": "cpe:2.3:a:oracle:secure_global_desktop:4.63:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F27D9960-00E7-4261-850B-D417858F88A7"
          },
          {
            "criteria": "cpe:2.3:a:oracle:secure_global_desktop:4.71:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E7F2CF7-CCB3-4EB7-AE44-637C12D97428"
          },
          {
            "criteria": "cpe:2.3:a:oracle:secure_global_desktop:5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "31356F14-F939-4552-8727-99B41B4BFF5B"
          },
          {
            "criteria": "cpe:2.3:a:oracle:secure_global_desktop:5.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B65FC68F-1348-462A-84EE-E8B7838A5524"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References