CVE-2011-4415
LOW 1.2
En bref
- Source
- NVD
- EPSS
- EPSS 3.02 % · centile 87 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Faiblesses (CWE)
- CWE-20 — Validation d'entrée incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | LOW 1.2 | AV:L/AC:H/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2011-4344
- GCVE · GCVE-0-2011-4415
Avis du CERT-FR
- CERTA-2012-AVI-358 — Multiples vulnérabilités dans HP System Management Homepage · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.0.64:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*- +15 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |