Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 524680 (CVE-2014-3581) - <www-servers/apache-{2.2.31, 2.4.20}: NULL pointer dereference in mod_cache if Content-Type has empty value (CVE-2014-3581)
Summary: <www-servers/apache-{2.2.31, 2.4.20}: NULL pointer dereference in mod_cache i...
Status: RESOLVED FIXED
Alias: CVE-2014-3581
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-07 09:41 UTC by Agostino Sarubbo
Modified: 2016-10-06 17:25 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-10-07 09:41:27 UTC
From ${URL} :

It was reported [1] that if Content-Type header value is empty, httpd with mod_cache enabled will 
segfault.
Upstream patch: http://svn.apache.org/viewvc?view=revision&revision=1624234

[1]: https://issues.apache.org/bugzilla/show_bug.cgi?id=56924


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2014-10-15 05:34:59 UTC
CVE-2014-3581 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3581):
  The cache_merge_headers_out function in modules/cache/cache_util.c in the
  mod_cache module in the Apache HTTP Server before 2.4.11 allows remote
  attackers to cause a denial of service (NULL pointer dereference and
  application crash) via an empty HTTP Content-Type header.
Comment 2 Pacho Ramos gentoo-dev 2016-02-08 19:03:06 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=1149709#c4

Per that, 2.2.x is not affected and neither the current 2.4 versions in the tree
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2016-07-18 03:08:26 UTC
Added to existing GLSA.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-10-06 17:25:52 UTC
This issue was resolved and addressed in
 GLSA 201610-02 at https://security.gentoo.org/glsa/201610-02
by GLSA coordinator Kristian Fiskerstrand (K_F).