REDHAT-BUG-2558397: Low severity Apache mod_qos vulnerability
A flaw was found in modqos. When QSSetEnvIfResBody is enabled, qosstrnstr() searches response buckets that need not be NUL-terminated. Its outer scan and exit checks, as well as its inner match loop, dereference input bytes before checking that they are within the supplied length, allowing reads beyond a response bucket. An unauthenticated remote client who triggers a response with suitable bucket contents and memory layout may cause an Apache worker process to crash, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
What configuration condition is required for exposure?
The flaw is reachable when QS_SetEnvIfResBody is enabled. The provided information does not establish whether this directive is enabled by default.
Does exploiting this issue require authentication or local access?
No. An unauthenticated remote client may trigger the vulnerable processing by causing a response with suitable bucket contents and memory layout.
What is the expected impact of a successful attack?
A successful exploit may crash an Apache worker process, causing denial of service. The supplied information describes an out-of-bounds read and does not state that code execution or data disclosure is possible.