[ GLSA 200508-15 ] Apache 2.0: Denial of Service vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: Apache 2.0: Denial of Service vulnerability (GLSA 200508-15)
Severity: normal
Exploitable: remote
Date: August 25, 2005
Updated: December 30, 2007
Bug(s): #102991
ID: 200508-15

Synopsis


A bug in Apache may allow a remote attacker to perform a Denial of Service
attack.


Background


The Apache HTTP Server Project is a featureful, freely-available HTTP
(Web) server.


Affected Packages

Package: www-servers/apache
Vulnerable: < 2.0.54-r9
Unaffected: >= 2.0.54-r9
Unaffected: < 2.0
Architectures: All supported architectures


Description


Filip Sneppe discovered that Apache improperly handles byterange
requests to CGI scripts.


Impact


A remote attacker may access vulnerable scripts in a malicious way,
exhausting all RAM and swap space on the server, resulting in a Denial
of Service of the Apache server.


Workaround


There is no known workaround at this time.


Resolution


All apache users should upgrade to the latest version: