CVE-2014-0231: Medium severity apache http server vulnerability
The following flaw has been fixed in the Apache HTTP Server:
"A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."
External References:
http://httpd.apache.org/security/vulnerabilities24.html
Other sources
The modcgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0231?
CVE-2014-0231 has been classified as a medium severity vulnerability that can lead to denial of service.
How do I fix CVE-2014-0231?
To fix CVE-2014-0231, you should upgrade to Apache HTTP Server version 2.4.10 or later.
Which versions of Apache HTTP Server are affected by CVE-2014-0231?
CVE-2014-0231 affects Apache HTTP Server versions between 2.2.0 and 2.2.29, and 2.4.0 to 2.4.9.
What causes the vulnerability described in CVE-2014-0231?
The vulnerability in CVE-2014-0231 is caused by a flaw in mod_cgid that allows remote attackers to hang child processes indefinitely.
Is CVE-2014-0231 exploitable remotely?
Yes, CVE-2014-0231 is exploitable remotely if the server hosts CGI scripts that do not consume standard input.