CVE-2014-0098: Medium severity Apache HTTP Server vulnerability
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/httpdto a version that resolves this vulnerability.Fixed in 2.4.8
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0098?
CVE-2014-0098 is classified as a medium severity vulnerability that can lead to denial of service.
How do I fix CVE-2014-0098?
To fix CVE-2014-0098, upgrade Apache HTTP Server to version 2.4.8 or later.
What effect does CVE-2014-0098 have on the system?
CVE-2014-0098 can cause a segmentation fault and crash the Apache HTTP Server when a malformed cookie is processed.
Which versions of Apache HTTP Server are affected by CVE-2014-0098?
CVE-2014-0098 affects Apache HTTP Server versions prior to 2.4.8 and versions 2.2.0 to 2.2.27.
Are there specific configurations that are at risk from CVE-2014-0098?
Any configuration of Apache HTTP Server that processes cookies is at risk from CVE-2014-0098.