CVE-2012-0021

LOW

Description

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

http://httpd.apache.org/security/vulnerabilities_22.html

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

http://marc.info/?l=bugtraq&m=133294460209056&w=2

http://marc.info/?l=bugtraq&m=133494237717847&w=2

http://rhn.redhat.com/errata/RHSA-2012-0542.html

http://rhn.redhat.com/errata/RHSA-2012-0543.html

http://secunia.com/advisories/48551

http://support.apple.com/kb/HT5501

http://svn.apache.org/viewvc?view=revision&revision=1227292

http://www.mandriva.com/security/advisories?name=MDVSA-2012:012

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

https://bugzilla.redhat.com/show_bug.cgi?id=785065

https://issues.apache.org/bugzilla/show_bug.cgi?id=52256

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2012-01-28

Updated: 2021-03-30

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 2.6

Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 4.9

Severity: LOW

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
104270SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)NessusSuSE Local Security Checks
critical
83578SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0469-1)NessusSuSE Local Security Checks
medium
80581Oracle Solaris Third-Party Patch Update : apache (cve_2012_0021_improper_input)NessusSolaris Local Security Checks
low
79733F5 Networks BIG-IP : Apache HTTP server vulnerabilities (SOL15889)NessusF5 Networks Local Security Checks
medium
78923RHEL 5 / 6 : JBoss Web Server (RHSA-2012:0542)NessusRed Hat Local Security Checks
medium
65023SuSE 11.2 Security Update : Apache (SAT Patch Number 7409)NessusSuSE Local Security Checks
medium
6583Mac OS X 10.7 < 10.7.5 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
62214Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
62213Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)NessusMacOS X Local Security Checks
critical
59851HP System Management Homepage < 7.1.1 Multiple VulnerabilitiesNessusWeb Servers
critical
59678GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
58252Fedora 15 : httpd-2.2.22-1.fc15 (2012-1642)NessusFedora Local Security Checks
medium
58050Fedora 16 : httpd-2.2.22-1.fc16 (2012-1598)NessusFedora Local Security Checks
medium
57999Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : apache2 vulnerabilities (USN-1368-1)NessusUbuntu Local Security Checks
medium
57892Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : httpd (SSA:2012-041-01)NessusSlackware Local Security Checks
medium
800552Apache 2.2 < 2.2.22 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
high
6302Apache 2.2 < 2.2.22 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
57819Mandriva Linux Security Advisory : apache (MDVSA-2012:012)NessusMandriva Local Security Checks
medium
57791Apache 2.2.x < 2.2.22 Multiple VulnerabilitiesNessusWeb Servers
medium
57786FreeBSD : apache -- multiple vulnerabilities (4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0)NessusFreeBSD Local Security Checks
medium