CVE-2012-0021

Published: Jan 28, 2012Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

Affected (5)

Products: Apache: Http Server

Apache

1 product

Http Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 2.2.17
Apache Http Server	Version 2.2.18
Apache Http Server	Version 2.2.19
Apache Http Server	Version 2.2.20
Apache Http Server	Version 2.2.21

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (56)

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: secalert@redhat.com

http://httpd.apache.org/security/vulnerabilities_22.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133294460209056&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133494237717847&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0542.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0543.html

Source: secalert@redhat.com

http://secunia.com/advisories/48551

Source: secalert@redhat.com

http://support.apple.com/kb/HT5501

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1227292

Source: secalert@redhat.com

Patch

http://www.mandriva.com/security/advisories?name=MDVSA-2012:012

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=785065

Source: secalert@redhat.com

https://issues.apache.org/bugzilla/show_bug.cgi?id=52256

Source: secalert@redhat.com

Patch

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041