CVE-2014-8109: Medium severity apache http server vulnerability
If an authorization script for LuaAuthzProvider were provided in the configuration multiple times, only the arguments of the last specification were used when invoking the script. This could lead to scripts being invoked with unexpected arguments.
Further details are available in the thread of the original report and bug:
http://www.openwall.com/lists/oss-security/2014/11/28/5
https://issues.apache.org/bugzilla/showbug.cgi?id=57204
Upstream fix:
https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb
This affects Apache HTTP Server versions 2.3 and later (such as what is shipped in Red Hat Enterprise Linux 7), as modlua is not available in earlier releases. Note that support for LuaAuthzProvider is experimental.
Other sources
modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8109?
CVE-2014-8109 is categorized as a moderate severity vulnerability that may result in scripts being executed with unintended arguments.
How do I fix CVE-2014-8109?
To fix CVE-2014-8109, ensure that the authorization script is only specified once in the configuration to avoid conflicts.
What versions are affected by CVE-2014-8109?
CVE-2014-8109 affects Apache HTTP Server versions 2.4.1 through 2.4.10 and select versions of Oracle Enterprise Manager Ops Center and specific Ubuntu releases.
Can CVE-2014-8109 lead to security issues?
Yes, CVE-2014-8109 can lead to potential security issues as it allows scripts to be invoked with incorrect parameters, possibly causing unintended access or actions.
Is there a patch available for CVE-2014-8109?
Yes, applying the appropriate updates to Apache HTTP Server from versions that are not vulnerable will mitigate CVE-2014-8109.