The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

According to its banner, the version of Oracle HTTP Server installed on the remote host is potentially affected by multiple vulnerabilities. 

Note that Nessus did not verify if patches or workarounds have been applied.

From Red Hat Security Advisory 2008:0967 :

Updated httpd packages that resolve several security issues and fix a bug are now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the mod_proxy Apache module. An attacker in control of a Web server to which requests were being proxied could have caused a limited denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)

A flaw was found in the mod_proxy_ftp Apache module. If Apache was configured to support FTP-over-HTTP proxying, a remote attacker could have performed a cross-site scripting attack. (CVE-2008-2939)

In addition, these updated packages fix a bug found in the handling of the 'ProxyRemoteMatch' directive in the Red Hat Enterprise Linux 4 httpd packages. This bug is not present in the Red Hat Enterprise Linux 3 or Red Hat Enterprise Linux 5 packages.

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues.

A flaw was found in the mod_proxy Apache module. An attacker in control of a Web server to which requests were being proxied could have caused a limited denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)

A flaw was found in the mod_proxy_ftp Apache module. If Apache was configured to support FTP-over-HTTP proxying, a remote attacker could have performed a cross-site scripting attack. (CVE-2008-2939)

In addition, these updated packages fix a bug found in the handling of the 'ProxyRemoteMatch' directive in the Scientific Linux 4 httpd packages. This bug is not present in the Scientific Linux 3 or Scientific Linux 5 packages.

According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.64. It is, therefore, affected by the following vulnerabilities :

  - An unspecified error exists in the handling of requests     without a path segment. (CVE-2010-1452)

  - Several modules, including 'mod_deflate', are     vulnerable to a denial of service attack as the     server can be forced to utilize CPU time compressing     a large file after client disconnect. (CVE-2009-1891)

  - An unspecified error exists in 'mod_proxy' related to     filtration of authentication credentials.     (CVE-2009-3095)  
  - A NULL pointer dereference issue exists in     'mod_proxy_ftp' in some error handling paths.
    (CVE-2009-3094)

  - An error exists in 'mod_ssl' making the server     vulnerable to the TLC renegotiation prefix injection     attack. (CVE-2009-3555)

  - An error exists in the handling of subrequests such     that the parent request headers may be corrupted.
    (CVE-2010-0434)

  - An error exists in 'mod_proxy_http' when handling excessive     interim responses making it vulnerable to a denial of     service attack. (CVE-2008-2364)

  - An error exists in 'mod_isapi' that allows the module     to be unloaded too early, which leaves orphaned callback     pointers. (CVE-2010-0425)

  - An error exists in 'mod_proxy_ftp' when wildcards are     in an FTP URL, which allows for cross-site scripting     attacks. (CVE-2008-2939)

Note that the remote web server may not actually be affected by these vulnerabilities.  Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

A DoS condition in apache2's mod_proxy has been fixed. CVE-2008-2364 has been assigned to this issue.

A vulnerability was discovered in the mod_proxy module in Apache where it did not limit the number of forwarded interim responses, allowing remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses (CVE-2008-2364).

A cross-site scripting vulnerability was found in the mod_proxy_ftp module in Apache that allowed remote attackers to inject arbitrary web script or HTML via wildcards in a pathname in an FTP URI (CVE-2008-2939).

The updated packages have been patched to prevent these issues.

Updated httpd packages that resolve several security issues and fix a bug are now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the mod_proxy Apache module. An attacker in control of a Web server to which requests were being proxied could have caused a limited denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)

A flaw was found in the mod_proxy_ftp Apache module. If Apache was configured to support FTP-over-HTTP proxying, a remote attacker could have performed a cross-site scripting attack. (CVE-2008-2939)

In addition, these updated packages fix a bug found in the handling of the 'ProxyRemoteMatch' directive in the Red Hat Enterprise Linux 4 httpd packages. This bug is not present in the Red Hat Enterprise Linux 3 or Red Hat Enterprise Linux 5 packages.

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues.

It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2007-6203)

It was discovered that Apache was vulnerable to a cross-site request forgery (CSRF) in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. (CVE-2007-6420)

It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. (CVE-2008-1678)

It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2008-2168)

It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. (CVE-2008-2364)

It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. (CVE-2008-2939).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

This update includes the latest release of httpd 2.2. Two security issues are fixed in this update: A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. In a forward proxy configuration, if a user of the proxy could be tricked into visiting a malicious web server, the proxy could be forced into consuming a large amount of stack or heap memory.
This could lead to an eventual process crash due to stack space exhaustion. A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. A remote attacker enabling compression in an SSL handshake could cause a memory leak in the server, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest release of httpd 2.2. A security issue is fixed in this update: A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. In a forward proxy configuration, if a user of the proxy could be tricked into visiting a malicious web server, the proxy could be forced into consuming a large amount of stack or heap memory. This could lead to an eventual process crash due to stack space exhaustion.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.9. It is, therefore, affected by multiple vulnerabilities :

  - Improper handling of excessive forwarded interim     responses may cause denial of service conditions in     mod_proxy_http. (CVE-2008-2364)

  - A cross-site request forgery vulnerability in the     balancer-manager interface of mod_proxy_balancer.
    (CVE-2007-6420)

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

The remote host is affected by the vulnerability described in GLSA-200807-06 (Apache: Denial of Service)

    Multiple vulnerabilities have been discovered in Apache:
    Dustin Kirkland reported that the mod_ssl module can leak memory when     the client reports support for a compression algorithm (CVE-2008-1678).
    Ryujiro Shibuya reported that the ap_proxy_http_process_response()     function in the mod_proxy module does not limit the number of forwarded     interim responses (CVE-2008-2364).
    sp3x of SecurityReason reported a Cross-Site Request Forgery     vulnerability in the balancer-manager in the mod_proxy_balancer module     (CVE-2007-6420).
  Impact :

    A remote attacker could exploit these vulnerabilities by connecting to     an Apache httpd, by causing an Apache proxy server to connect to a     malicious server, or by enticing a balancer administrator to connect to     a specially crafted URL, resulting in a Denial of Service of the Apache     daemon.
  Workaround :

    There is no known workaround at this time.

Apache HTTP server project reports :

The following potential security flaws are addressed :

- CVE-2008-2364: mod_proxy_http: Better handling of excessive interim responses from origin server to prevent potential denial of service and high memory usage. Reported by Ryujiro Shibuya.

- CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager interface

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.9.  Such versions may be affected by several issues, including :

  - Improper handling of excessive forwarded interim responses may cause denial of service conditions in mod_proxy_http (CVE-2008-2364).
  - A cross-site request forgery vulnerability in the balancer-manager interface of mod_proxy_balancer (CVE-2007-6420).
  - An issue exists in the handling of the 'Options' and 'AllowOverride' directives (CVE-2009-1195).

Note that the remote web server may not actually be affected by these vulnerabilities.  NNM cannot determine whether the affected modules are in use.

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.9.  Such versions may be affected by several issues, including :

  - Improper handling of excessive forwarded interim responses may cause denial of service conditions in mod_proxy_http (CVE-2008-2364).
  - A cross-site request forgery vulnerability in the balancer-manager interface of mod_proxy_balancer (CVE-2007-6420).
  - An issue exists in the handling of the 'Options' and 'AllowOverride' directives (CVE-2009-1195).

Note that the remote web server may not actually be affected by these vulnerabilities.

ID	Name	Product	Family	Severity
69301	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities	Nessus	Web Servers	critical
67760	Oracle Linux 3 / 4 / 5 : httpd (ELSA-2008-0967)	Nessus	Oracle Linux Local Security Checks	medium
60493	Scientific Linux Security Update : httpd on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
50069	Apache 2.0.x < 2.0.64 Multiple Vulnerabilities	Nessus	Web Servers	high
41473	SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6035)	Nessus	SuSE Local Security Checks	medium
37114	Mandriva Linux Security Advisory : apache (MDVSA-2008:195)	Nessus	Mandriva Local Security Checks	medium
37062	CentOS 3 / 4 / 5 : httpd (CESA-2008:0967)	Nessus	CentOS Local Security Checks	medium
36589	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : apache2 vulnerabilities (USN-731-1)	Nessus	Ubuntu Local Security Checks	medium
35920	openSUSE 10 Security Update : apache2 (apache2-6054)	Nessus	SuSE Local Security Checks	medium
34751	RHEL 3 / 4 / 5 : httpd (RHSA-2008:0967)	Nessus	Red Hat Local Security Checks	medium
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	critical
33840	Fedora 9 : httpd-2.2.9-1.fc9 (2008-6393)	Nessus	Fedora Local Security Checks	medium
33839	Fedora 8 : httpd-2.2.9-1.fc8 (2008-6314)	Nessus	Fedora Local Security Checks	medium
33477	Apache 2.2.x < 2.2.9 Multiple Vulnerabilities (DoS, XSS)	Nessus	Web Servers	medium
33473	GLSA-200807-06 : Apache: Denial of Service	Nessus	Gentoo Local Security Checks	medium
33242	FreeBSD : apache -- multiple vulnerabilities (c84dc9ad-41f7-11dd-a4f9-00163e000016)	Nessus	FreeBSD Local Security Checks	medium
4579	Apache < 2.2.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
800558	Apache < 2.2.9 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2008-2364

high

Tenable Plugins

critical

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

high

medium