CVE-2011-3192
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 98.95 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
- http://secunia.com/advisories/45606
- http://www.redhat.com/support/errata/RHSA-2011-1369.html
- http://www.redhat.com/support/errata/RHSA-2011-1329.html
- http://marc.info/?l=bugtraq&m=131731002122529&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html
- http://marc.info/?l=bugtraq&m=134987041210674&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html
- http://www.gossamer-threads.com/lists/apache/dev/401638
- http://securitytracker.com/id?1025960
- http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g%40mail.gmail.com%3e
- https://bugzilla.redhat.com/show_bug.cgi?id=732928
- http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html
- http://marc.info/?l=bugtraq&m=133477473521382&w=2
- http://www.exploit-db.com/exploits/17696
- https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
- http://marc.info/?l=bugtraq&m=131551295528105&w=2
- http://secunia.com/advisories/46000
- http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html
- http://blogs.oracle.com/security/entry/security_alert_for_cve_2011
- http://marc.info/?l=bugtraq&m=132033751509019&w=2
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml
- http://www.ubuntu.com/usn/USN-1199-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:130
- http://www.securityfocus.com/bid/49303
- http://osvdb.org/74721
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824
- http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD%40minotaur.apache.org%3e
- http://www.redhat.com/support/errata/RHSA-2011-1330.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69396
- http://secunia.com/advisories/46126
- http://www.redhat.com/support/errata/RHSA-2011-1245.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827
- http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- http://www.apache.org/dist/httpd/Announcement2.2.html
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- http://secunia.com/advisories/46125
- http://www.kb.cert.org/vuls/id/405811
- http://seclists.org/fulldisclosure/2011/Aug/175
- http://marc.info/?l=bugtraq&m=133951357207000&w=2
- http://support.apple.com/kb/HT5002
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html
- http://www.redhat.com/support/errata/RHSA-2011-1294.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html
- +22 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2011-3156
- GCVE · GCVE-0-2011-3192
CERT-FR advisories
- CERTFR-2014-AVI-357 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-713 — Vulnérabilité dans Avaya Experience Portal · cert.ssi.gouv.fr
- CERTA-2012-AVI-566 — Vulnérabilités dans HP Secure Web Server · cert.ssi.gouv.fr
- CERTA-2012-AVI-393 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2012-AVI-316 — Multiples vulnérabilités dans HP Onboard Administrator · cert.ssi.gouv.fr
- CERTA-2012-AVI-221 — Vulnérabilité dans HP Onboard Administrator · cert.ssi.gouv.fr
- CERTA-2012-AVI-218 — Multiples vulnérabilités dans HP System Management Homepage · cert.ssi.gouv.fr
- CERTA-2012-AVI-024 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2012-AVI-023 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTA-2011-AVI-618 — Vulnérabilités dans HP OpenView Network Node Manager · cert.ssi.gouv.fr
- CERTA-2011-AVI-586 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2011-AVI-564 — Multiples vulnérabilités dans Apple Mac OS X · cert.ssi.gouv.fr
- CERTA-2011-AVI-560 — Vulnérabilités dans Cadic Intégrale · cert.ssi.gouv.fr
- CERTA-2011-AVI-530 — Vulnérabilité dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2011-AVI-494 — Vulnérabilité dans Hitachi Web Serveur · cert.ssi.gouv.fr
- CERTA-2011-AVI-490 — Vulnérabilité dans Apache httpd · cert.ssi.gouv.fr
- CERTA-2011-AVI-488 — Vulnérabilité dans les produits Cisco · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*≥ 2.0.35 < 2.0.65cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*≥ 2.2.0 < 2.2.20cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:*cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |