Additional problems were discovered in the httpd fix for CVE-2011-3368 - a reverse proxy bypass flaw - tracked via bug #740045. Upstream mailing list post identifies following request forms, which are not handled correctly:
GET @localhost::8880 HTTP/1.0\r\n\r\n GET qualys:@qqq.qq.qualys.com HTTP/1.0\r\n\r\n
Reference: http://thread.gmane.org/gmane.comp.apache.devel/46440
SUSE reported that upstream patch for CVE-2011-3368 (bug #740045), when applied to httpd versions before 2.2.18, does not completely address the issue, when attacker sends HTTP 0.9 requests::
https://bugzilla.novell.com/showbug.cgi?id=722545#c15 http://thread.gmane.org/gmane.comp.apache.devel/45978 http://thread.gmane.org/gmane.comp.security.oss.general/6102
The fix has been created upstream and committed to trunk:
http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45979 http://svn.apache.org/viewvc?view=revision&revision=1188745
Upstream also confirmed this additional fix is not required for httpd versions 2.2.18 and later:
http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45983 http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45985
Integer overflow in the appregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the modsetenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
RMDG partner and independent security consultancy, "Context Information Security" has made CPNI Response aware of a security vulnerability which could potentially allow an attacker to gain full internal access to a network from the internet.
The technique exploits insecurely configured reverse web proxies to gain access to internal/DMZ systems.
This attack is based on an Apache web server which is using "modrewrite" to proxy web requests internally. Other proxies may suffer from this issue.
The vulnerability occurs if the Apache configuration file is configured like this:
RewriteRule ^(.) http://internalserver:80$1 [P]
As opposed to:
RewriteRule ^(.) http://internalserver:80/$1 [P]
It is important for readers to review their reverse proxy configurations to ensure that the rewrite rules are securely configured and cannot be abused in such a way that they can be used to compromise internal systems.
Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.
Memory leak in the aprbrigadesplitline function in buckets/aprbrigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the modreqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
The (1) modcache and (2) moddav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15
low: Request header information leak CVE-2010-0434
A bug in the handling of headers in subrequests could lead to a reuse of memory. In a multithreaded MPM this could possibly cause an information leak from other requests being handled by a different thread.
Affects: 2.2.0 - 2.2.14
Upstream bug: https://issues.apache.org/bugzilla/showbug.cgi?id=48359
Upstream commits (2.2.x branch): http://svn.apache.org/viewvc?view=revision&revision=917867 http://svn.apache.org/viewvc?view=revision&revision=918427
Expat is vulnerable to a denial of service, caused by the improper handling of XML data by the big2toUtf8 function within the libexpat library. A remote attacker could exploit this vulnerability using a specially-crafted XML document containing malformed UTF-8 sequences that trigger a buffer over-read to cause the application to crash.
The modproxyftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
References: http://intevydis.com/vd-list.shtml
Peter Valchev discovered a flaw in the way expat handled malformed UTF-8 sequences when processing XML files. Incorrect UTF-8 sequenced could cause expat to fail to properly detect end of input and continue reading behind the end of input buffer. This results in a crash once reading reaches unmapped memory.
Non-public upstream bug report: http://sourceforge.net/tracker/?func=detail&aid=1990430&groupid=10127&atid=110127
Contents of the report leaked via expat-bugs mailing list posts: http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html
Upstream patch: http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltokimpl.c?r1=1.13&r2=1.15
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551936 https://bugs.gentoo.org/showbug.cgi?id=280615
The approxyhttpprocessresponse function in modproxyhttp.c in the modproxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
Cross-site scripting (XSS) vulnerability in modstatus in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Cross-site scripting (XSS) vulnerability in the (1) modimap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) modimagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Cross-site scripting (XSS) vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
The date handling code in modules/proxy/proxyutil.c (modproxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
Format string vulnerability in the modtcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a setvar function call in (1) tclcmds.c and (2) tclcore.c.
modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
Cross-site scripting (XSS) vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
Off-by-one error in the modssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
The moddav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
modssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
PHP 4.3.4 and earlier in Apache 1.x and 2.x (modphp) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
DISPUTED The modphp module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."