CVE-2014-3523: Medium severity apache http server vulnerability
Memory leak in the winntaccept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Other sources
The following flaw has been fixed in the Apache HTTP Server:
"A flaw was found in the WinNT MPM in httpd versions 2.4.1 to 2.4.9, when using the default AcceptFilter for that platform. A remote attacker could send carefully crafted requests that would leak memory and eventually lead to a denial of service against the server."
External References:
http://httpd.apache.org/security/vulnerabilities24.html
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3523?
CVE-2014-3523 has a medium severity level associated with potential denial of service due to memory consumption.
How do I fix CVE-2014-3523?
To address CVE-2014-3523, upgrade the Apache HTTP Server to version 2.4.10 or later.
Which versions of Apache HTTP Server are affected by CVE-2014-3523?
CVE-2014-3523 affects Apache HTTP Server versions 2.4.1 through 2.4.9.
What is the nature of the vulnerability in CVE-2014-3523?
CVE-2014-3523 is characterized by a memory leak in the winnt_accept function, allowing attackers to exploit it for denial of service.
What operating system is CVE-2014-3523 relevant to?
CVE-2014-3523 is specifically relevant to the Windows operating system when running affected versions of Apache HTTP Server.