xfocus logo xfocus title
首页 焦点原创 安全文摘 安全工具 安全漏洞 焦点项目 焦点论坛 关于我们
English Version

Apache Web Server Prefork MPM远程拒绝服务攻击漏洞


发布时间:2003-07-08
更新时间:2003-07-11
严重程度:
威胁程度:读取受限文件
错误类型:意外情况处置错误
利用方式:服务器模式

BUGTRAQ ID:8137
CVE(CAN) ID:CAN-2003-0253

受影响系统
Apache Software Foundation Apache 2.0
Apache Software Foundation Apache 2.0.28
Apache Software Foundation Apache 2.0.32
Apache Software Foundation Apache 2.0.35
Apache Software Foundation Apache 2.0.36
Apache Software Foundation Apache 2.0.37
Apache Software Foundation Apache 2.0.38
Apache Software Foundation Apache 2.0.39
Apache Software Foundation Apache 2.0.40
   + RedHat Linux 8.0
   + RedHat Linux 9.0 i386
   + Terra Soft Solutions Yellow Dog Linux 3.0
Apache Software Foundation Apache 2.0.41
Apache Software Foundation Apache 2.0.42
   + Gentoo Linux 1.2
   + Gentoo Linux 1.4 _rc1
Apache Software Foundation Apache 2.0.43
Apache Software Foundation Apache 2.0.44
   + MandrakeSoft Linux Mandrake 9.1
   + MandrakeSoft Linux Mandrake 9.1 ppc
Apache Software Foundation Apache 2.0.45
   - Apple MacOS X 10.0
   - Apple MacOS X 10.0.1
   - Apple MacOS X 10.0.2
   - Apple MacOS X 10.0.3
   - Apple MacOS X 10.0.4
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1
   - Apple MacOS X 10.1.1
   - Apple MacOS X 10.1.2
   - Apple MacOS X 10.1.3
   - Apple MacOS X 10.1.4
   - Apple MacOS X 10.1.5
   - Apple MacOS X 10.2
   - Apple MacOS X 10.2.1
   - Apple MacOS X 10.2.2
   - Apple MacOS X 10.2.3
   - Apple MacOS X 10.2.4
   - Apple MacOS X 10.2.5
   - Apple MacOS X 10.2.6
   + Conectiva Linux 9.0
Apache Software Foundation Apache 2.0.46
   + Trustix Secure Linux 2.0
详细描述
Apache prefork MPM (Multi-Processing Module)处理中存在漏洞,可导致产生拒绝服务条件。

目前没有详细漏洞细节提供。

测试代码
尚无

解决方案
升级程序:

Apache Software Foundation Apache 2.0:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.28:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.32:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.35:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.36:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.37:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.38:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.39:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.40:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.41:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.42:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.43:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.44:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.45:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Apache Software Foundation Apache 2.0.46:

Apache Software Foundation Upgrade Apache httpd 2.0.47
http://httpd.apache.org/download.cgi

Trustix Patch apache-2.0.47-2tr.i586.rpm
ftp://ftp.trustix.net/pub/Trustix/updates/2.0/RPMS/apache-2.0.47-2tr.i586.rpm

Trustix Patch apache-devel-2.0.47-2tr.i586.rpm
ftp://ftp.trustix.net/pub/Trustix/updates/2.0/RPMS/apache-devel-2.0.47-2tr.i586.rpm

Trustix Patch apache-manual-2.0.47-2tr.i586.rpm
ftp://ftp.trustix.net/pub/Trustix/updates/2.0/RPMS/apache-manual-2.0.47-2tr.i586.rpm

相关信息
参考:http://www.apache.org/dist/httpd/CHANGES_2.0
http://www.securityfocus.com/advisories/5570