CVE-2012-0021: Input Validation
A flaw [1] was found in modlogconfig. If an administrator configured the "%{cookiename}C" log format string to be used, a remote attacker could send a specific cookie which would cause a crash. This crash would only be a denial of service if using a threaded MPM (such as event or worker). Note that Red Hat Enterprise Linux and Fedora use the prefork MPM by default.
This will be fixed upstream [2] in 2.2.22 and affects versions 2.2.17 up to and including 2.2.21.
[1] https://issues.apache.org/bugzilla/showbug.cgi?id=52256 [2] http://svn.apache.org/viewvc?view=revision&revision=1227292
Statement:
Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 4, 5, or 6.
Other sources
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0021?
CVE-2012-0021 poses a denial of service risk primarily affecting installations using a threaded multi-processing module.
How do I fix CVE-2012-0021?
To mitigate CVE-2012-0021, upgrade to Apache HTTP Server version 2.2.22 or later.
Which versions of Apache HTTP Server are affected by CVE-2012-0021?
CVE-2012-0021 affects Apache HTTP Server versions 2.2.17 through 2.2.21.
Is CVE-2012-0021 exploitable remotely?
Yes, CVE-2012-0021 can be exploited remotely by sending specially crafted cookies.
What impact does CVE-2012-0021 have on system availability?
CVE-2012-0021 can lead to a crash of the web server, resulting in temporary unavailability.