NetSight
IP …
medium4.3Public exploit code

CVE-2011-0419

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Se…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.

Affected products

VendorProductAffected versions
ApachePortable Runtime
before 1.4.3
ApacheHttp Server
from 2.0.0 through 2.0.65
from 2.2.0 through 2.2.18
AppleMac Os X
Version 10.6.0
FreebsdFreebsd
All versions
GoogleAndroid
All versions
NetbsdNetbsd
Version 5.1
OpenbsdOpenbsd
Version 4.8
OracleSolaris
Version 10
DebianDebian Linux
Versions 5.0, 6.0, 7.0
SuseLinux Enterprise Server
Version 10

Weakness classification

CWE-770

References