NetSight
IP …
medium4.3

CVE-2013-1896

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial…

Impact

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.2.0 before 2.2.25
from 2.4.1 before 2.4.6
RedhatJboss Enterprise Application Platform
Versions 6.0.0, 6.4.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0
RedhatEnterprise Linux Eus
Versions 5.9, 6.4
RedhatEnterprise Linux Server
Versions 5.0, 6.0
RedhatEnterprise Linux Server Aus
Versions 5.9, 6.4
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0
CanonicalUbuntu Linux
Versions 10.04, 12.04, 12.10, 13.04
OpensuseOpensuse
Versions 11.4, 12.2, 12.3

References