Vulnerability CVE-2007-1349


Published: 2007-03-29   Modified: 2011-03-07

Description:
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

Type:

CWE-399

(Resource Management Errors)

Vendor: Apache
Product: Mod perl 
Version:
2.0.3
2.0.2
2.0.1
2.0.0
Product: Apache test 
Version: 1.29;
Product: Http server 

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial

 References:
http://www.securityfocus.com/bid/23192
http://www.vupen.com/english/advisories/2007/1150
http://www.ubuntu.com/usn/usn-488-1
http://www.securitytracker.com/id?1018259
http://www.redhat.com/support/errata/RHSA-2008-0627.html
http://www.redhat.com/support/errata/RHSA-2008-0261.html
http://www.redhat.com/support/errata/RHSA-2007-0486.html
http://www.redhat.com/support/errata/RHSA-2007-0396.html
http://www.novell.com/linux/security/advisories/2007_8_sr.html
http://www.novell.com/linux/security/advisories/2007_12_sr.html
http://www.mandriva.com/security/advisories?name=MDKSA-2007:083
http://www.gossamer-threads.com/lists/modperl/modperl/92739
http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes
http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1
http://security.gentoo.org/glsa/glsa-200705-04.xml
http://secunia.com/advisories/33723
http://secunia.com/advisories/33720
http://secunia.com/advisories/31493
http://secunia.com/advisories/31490
http://secunia.com/advisories/26290
http://secunia.com/advisories/26231
http://secunia.com/advisories/26084
http://secunia.com/advisories/25894
http://secunia.com/advisories/25730
http://secunia.com/advisories/25655
http://secunia.com/advisories/25432
http://secunia.com/advisories/25110
http://secunia.com/advisories/25072
http://secunia.com/advisories/24839
http://secunia.com/advisories/24678
http://rhn.redhat.com/errata/RHSA-2008-0630.html
http://rhn.redhat.com/errata/RHSA-2007-0395.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8349
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10987
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc

Related CVE
CVE-2011-4343
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CVE-2010-2245
XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document.
CVE-2017-9801
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
CVE-2016-8743
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in...
CVE-2016-2161
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
CVE-2016-0736
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated en...
CVE-2017-7659
A maliciously constructed HTTP/2 request could cause mod_http2 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
CVE-2015-3208
XML external entity (XXE) vulnerability in the XPath selector component in Artemis ActiveMQ before commit 48d9951d879e0c8cbb59d4b64ab59d53ef88310d allows remote attackers to have unspecified impact via unknown vectors.

Copyright 2017, cxsecurity.com