Multiple cross-site scripting (XSS) vulnerabilities in the makevariantlist function in modnegotiation.c in the modnegotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

It was reported [1] that an integer overflow was found in Apache in the appregsub() function called from mod-setenvif. When a header field is mangled using SetEnvIf, the new environment variable data can be multiples of the size of the submitted header field. This would cause appregsub() to overflow the length value in buffer size calculations, leading to the subsequent allocation call of a too-small buffer. Filling this buffer with user-supplied data will lead to a buffer overflow.

Depending on the input data, this can lead to excessive allocation of server memory (resulting in killed processes due to out-of-memory conditions), invalid memory access when copying large amounts of data (which can lead to a termination of the httpd process), or possibly allowing the execution of arbitrary code.

To trigger this flaw, modsetenvif must be enabled (the default) and the attacker needs to be able to place a crafted .htaccess file on the server (which, in most cases, would require local access to the file system or some web interface that allows for writing arbitrary files to the local file system, such as for custom .htaccess files).

There is currently no upstream fix, however to work around the problem, disable modsetenvif.

[1] http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/

A NULL pointer dereference flaw was discovered in httpd's modproxyftp module. Malicious FTP server can use this flaw to crash httpd's child process via malformed reply to EPSV FTP command.

Problem was confirmed in both 2.0.x and 2.2.x httpd versions.

References: http://www.intevydis.com/blog/?p=59 http://secunia.com/advisories/36549/

CRLF injection vulnerability in the modnegotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.