Bug 409373 – <www-apache/mod_fcgid-2.3.7: FcgidMaxProcessesPerClass is ignored in VirtualHost (CVE-2012-1181)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2012-03-22 20:26:11 UTC]

CVE-2012-1181 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1181):
  fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server
  does not recognize the FcgidMaxProcessesPerClass directive for a virtual
  host, which makes it easier for remote attackers to cause a denial of
  service (memory consumption) via a series of HTTP requests that triggers a
  process count higher than the intended limit.

[Comment 1 Hanno Böck 2012-04-29 17:22:21 UTC]

According to upstream this is fixed in 2.3.7:
https://issues.apache.org/bugzilla/show_bug.cgi?id=49902

[Comment 2 Lance Albertson (RETIRED) 2012-05-13 08:38:17 UTC]

(In reply to comment #1)
> According to upstream this is fixed in 2.3.7:
> https://issues.apache.org/bugzilla/show_bug.cgi?id=49902

I just pushed 2.3.7 to portage FYI.

[Comment 3 Tim Sammut (RETIRED) 2012-05-14 01:01:46 UTC]

Great, thanks.

Arches, please test and mark stable:
=www-apache/mod_fcgid-2.3.7
Target keywords : "amd64 ppc x86"

[Comment 4 Agostino Sarubbo 2012-05-14 18:31:09 UTC]

amd64 stable

[Comment 5 Paweł Hajdan, Jr. (RETIRED) 2012-05-21 10:01:18 UTC]

x86 stable

[Comment 6 Brent Baude (RETIRED) 2012-06-08 17:42:16 UTC]

ppc done

[Comment 7 Tim Sammut (RETIRED) 2012-06-10 15:31:19 UTC]

Thanks, folks. GLSA Vote: yes.

[Comment 8 Sean Amoss (RETIRED) 2012-06-11 23:18:22 UTC]

GLSA vote: yes.

Added to existing GLSA request.

[Comment 9 GLSAMaker/CVETool Bot 2012-07-09 23:36:57 UTC]

This issue was resolved and addressed in
 GLSA 201207-09 at http://security.gentoo.org/glsa/glsa-201207-09.xml
by GLSA coordinator Sean Amoss (ackle).