NetSight
IP …
high7.1

CVE-2009-1890

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not…

Impact

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.2.0 before 2.2.12
FedoraprojectFedora
Version 11
DebianDebian Linux
Versions 4.0, 5.0, 6.0
CanonicalUbuntu Linux
Versions 6.06, 8.04, 8.10, 9.04
RedhatEnterprise Linux Desktop
Version 5.0
RedhatEnterprise Linux Eus
Version 5.3
RedhatEnterprise Linux Server
Version 5.0
RedhatEnterprise Linux Server Aus
Version 5.3
RedhatEnterprise Linux Workstation
Version 5.0

Weakness classification

CWE-400

References