National Cyber Awareness System

Vulnerability Summary for CVE-2009-1891

Overview

The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: REDHAT

Name: RHSA-2009:1148

Type: Patch Information

Hyperlink:https://rhn.redhat.com/errata/RHSA-2009-1148.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=509125

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=509125

External Source: MANDRIVA

Name: MDVSA-2009:149

Type: Patch Information

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:149

External Source: FEDORA

Name: FEDORA-2009-8812

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html

External Source: VUPEN

Name: ADV-2009-3184

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/3184

External Source: VUPEN

Name: ADV-2009-1841

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/1841

External Source: UBUNTU

Name: USN-802-1

Hyperlink:http://www.ubuntu.com/usn/USN-802-1

External Source: SECTRACK

Name: 1022529

Hyperlink:http://www.securitytracker.com/id?1022529

External Source: BUGTRAQ

Name: 20091113 rPSA-2009-0142-2 httpd mod_ssl

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/507857/100/0/threaded

External Source: REDHAT

Name: RHSA-2009:1156

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-1156.html

External Source: DEBIAN

Name: DSA-1834

Hyperlink:http://www.debian.org/security/2009/dsa-1834

External Source: AIXAPAR

Name: PK99480

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480

External Source: AIXAPAR

Name: PK91361

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2009-0142

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2009-0142

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3937

Hyperlink:http://support.apple.com/kb/HT3937

External Source: GENTOO

Name: GLSA-200907-04

Hyperlink:http://security.gentoo.org/glsa/glsa-200907-04.xml

External Source: SECUNIA

Name: 37221

Type: Advisory

Hyperlink:http://secunia.com/advisories/37221

External Source: SECUNIA

Name: 37152

Type: Advisory

Hyperlink:http://secunia.com/advisories/37152

External Source: SECUNIA

Name: 35865

Type: Advisory

Hyperlink:http://secunia.com/advisories/35865

External Source: SECUNIA

Name: 35793

Type: Advisory

Hyperlink:http://secunia.com/advisories/35793

External Source: SECUNIA

Name: 35781

Type: Advisory

Hyperlink:http://secunia.com/advisories/35781

External Source: SECUNIA

Name: 35721

Type: Advisory

Hyperlink:http://secunia.com/advisories/35721

External Source: OVAL

Name: oval:org.mitre.oval:def:9248

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9248

External Source: OVAL

Name: oval:org.mitre.oval:def:8632

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8632

External Source: OVAL

Name: oval:org.mitre.oval:def:12361

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12361

External Source: OSVDB

Name: 55782

Hyperlink:http://osvdb.org/55782

External Source: HP

Name: SSRT090208

Hyperlink:http://marc.info/?l=bugtraq&m=130497311408250&w=2

External Source: HP

Name: HPSBOV02683

Hyperlink:http://marc.info/?l=bugtraq&m=130497311408250&w=2

External Source: HP

Name: HPSBUX02612

Hyperlink:http://marc.info/?l=bugtraq&m=129190899612998&w=2

External Source: HP

Name: HPSBUX02612

Hyperlink:http://marc.info/?l=bugtraq&m=129190899612998&w=2

External Source: MLIST

Name: [apache-httpd-dev] 20090703 Re: mod_deflate DoS

Hyperlink:http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2

External Source: MLIST

Name: [apache-httpd-dev] 20090628 mod_deflate DoS

Hyperlink:http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2

External Source: SUSE

Name: SUSE-SA:2009:050

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html

External Source: APPLE

Name: APPLE-SA-2009-11-09-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html

External Source: MISC

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712

References to Check Content

Identifier:oval:org.mitre.oval:def:9248

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9248

Identifier:oval:org.mitre.oval:def:8632

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:8632

Identifier:oval:org.mitre.oval:def:12361

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12361