CVE-2011-3348

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.

References

http://www.securityfocus.com/bid/49616

http://httpd.apache.org/security/vulnerabilities_22.html#2.2.21

http://www.securitytracker.com/id?1026054

http://secunia.com/advisories/46013

http://www.apache.org/dist/httpd/Announcement2.2.html

http://community.jboss.org/message/625307

http://www.redhat.com/support/errata/RHSA-2011-1391.html

http://marc.info/?l=bugtraq&m=131731002122529&w=2

http://marc.info/?l=bugtraq&m=132033751509019&w=2

http://www.mandriva.com/security/advisories?name=MDVSA-2011:168

http://support.apple.com/kb/HT5130

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/69804

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18154

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14941

http://rhn.redhat.com/errata/RHSA-2012-0543.html

http://rhn.redhat.com/errata/RHSA-2012-0542.html

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2011-09-20

Updated: 2021-06-06

Type: CWE-399

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:0.8.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:0.8.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions up to 2.2.20 (inclusive)

cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.99:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.2.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.2.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:1.2.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*

Tenable Plugins

View all (22 total)

IDNameProductFamilySeverity
78923RHEL 5 / 6 : JBoss Web Server (RHSA-2012:0542)NessusRed Hat Local Security Checks
medium
78270Amazon Linux AMI : httpd (ALAS-2011-9)NessusAmazon Linux Local Security Checks
medium
75787openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1)NessusSuSE Local Security Checks
high
75426openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1)NessusSuSE Local Security Checks
high
69568Amazon Linux AMI : httpd (ALAS-2011-09)NessusAmazon Linux Local Security Checks
medium
69301Oracle Fusion Middleware Oracle HTTP Server Multiple VulnerabilitiesNessusWeb Servers
critical
68376Oracle Linux 6 : httpd (ELSA-2011-1391)NessusOracle Linux Local Security Checks
medium
61161Scientific Linux Security Update : httpd on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
59678GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
58811HP System Management Homepage < 7.0 Multiple VulnerabilitiesNessusWeb Servers
critical
6303Mac OS X 10.7 < 10.7.3 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
57798Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)NessusMacOS X Local Security Checks
critical
57797Mac OS X 10.7.x < 10.7.3 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
57089SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5344)NessusSuSE Local Security Checks
high
56778Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : apache2, apache2-mpm-itk vulnerabilities (USN-1259-1)NessusUbuntu Local Security Checks
medium
56764Mandriva Linux Security Advisory : apache (MDVSA-2011:168)NessusMandriva Local Security Checks
medium
800559Apache 2.2 < 2.2.21 mod_proxy_ajp DoSLog Correlation EngineWeb Servers
high
6062Apache 2.2 < 2.2.21 mod_proxy_ajp DoSNessus Network MonitorWeb Servers
low
56578RHEL 6 : httpd (RHSA-2011:1391)NessusRed Hat Local Security Checks
medium
56513Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : httpd (SSA:2011-284-01)NessusSlackware Local Security Checks
medium
56216Apache 2.2.x < 2.2.21 mod_proxy_ajp DoSNessusWeb Servers
medium
56084Mandriva Linux Security Advisory : apache (MDVSA-2011:130-1)NessusMandriva Local Security Checks
high