NVD

Id
10869  
Name
CVE-2011-4415  
Description
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.  
Reject
 
CVSS Version
2  
CVSS Score
1.2  
Severity
Low  
CVSS Base Score
1.2  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-07  
Published
2011-11-08  
Modified Date
2012-07-03  
Seq
2011-4415  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60897 10869 CVE-2011-4415 SSRT100877  View
60898 10869 CVE-2011-4415 http://www.gossamer-threads.com/lists/apache/dev/403775  View
60899 10869 CVE-2011-4415 http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/  View
60900 10869 CVE-2011-4415 http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32546 JVNDB-2011-002786 Apache HTTP Server におけるサービス運用妨害 (DoS) の脆弱性 Apache HTTP Server の server/util.c 内にある ap_pregsub 関数は、mod_setenvif モジュールが有効な際、環境変数の値のサイズを制限しないため、サービス運用妨害 (メモリ消費、または NULL ポインタデリファレンス) 状態となる脆弱性が存在します。 CVE-2011-4415 52322 CVE-2011-4415 10869 1.2 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002786.html 2011-11-08 2012-06-08 View