Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

The following flaw has been fixed in the Apache HTTP Server:

"A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."

External References:

http://httpd.apache.org/security/vulnerabilities24.html

Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.

Discussion and a possible patch is available from the following thread:

http://marc.info/?t=138219209900002&r=1&w=2

References:

http://martin.swende.se/blog/HTTPChunked.html

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4558 tothe following vulnerability:

Name: CVE-2012-4558 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558 Assigned: 20120821 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxybalancer.c?r1=1404653&r2=1413732&diffformat=h

Multiple cross-site scripting (XSS) vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3499 to the following vulnerability:

Name: CVE-2012-3499 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 Assigned: 20120614 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modinfo.c?r1=1225799&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modstatus.c?r1=1389564&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/utilldapcachemgr.c?r1=1209766&r2=1418752&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/modimagemap.c?r1=1398480&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxyftp.c?r1=1404625&r2=1413732&diffformat=h

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) modimagemap, (2) modinfo, (3) modldap, (4) modproxyftp, and (5) modstatus modules.

The modproxyajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.

Additional problems were discovered in the httpd fix for CVE-2011-3368 - a reverse proxy bypass flaw - tracked via bug #740045. Upstream mailing list post identifies following request forms, which are not handled correctly:

GET @localhost::8880 HTTP/1.0\r\n\r\n GET qualys:@qqq.qq.qualys.com HTTP/1.0\r\n\r\n

Reference: http://thread.gmane.org/gmane.comp.apache.devel/46440

SUSE reported that upstream patch for CVE-2011-3368 (bug #740045), when applied to httpd versions before 2.2.18, does not completely address the issue, when attacker sends HTTP 0.9 requests::

https://bugzilla.novell.com/showbug.cgi?id=722545#c15 http://thread.gmane.org/gmane.comp.apache.devel/45978 http://thread.gmane.org/gmane.comp.security.oss.general/6102

The fix has been created upstream and committed to trunk:

http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45979 http://svn.apache.org/viewvc?view=revision&revision=1188745

Upstream also confirmed this additional fix is not required for httpd versions 2.2.18 and later:

http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45983 http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45985

Integer overflow in the appregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the modsetenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

RMDG partner and independent security consultancy, "Context Information Security" has made CPNI Response aware of a security vulnerability which could potentially allow an attacker to gain full internal access to a network from the internet.

The technique exploits insecurely configured reverse web proxies to gain access to internal/DMZ systems.

This attack is based on an Apache web server which is using "modrewrite" to proxy web requests internally. Other proxies may suffer from this issue.

The vulnerability occurs if the Apache configuration file is configured like this:

RewriteRule ^(.) http://internalserver:80$1 [P]

As opposed to:

RewriteRule ^(.) http://internalserver:80/$1 [P]

It is important for readers to review their reverse proxy configurations to ensure that the rewrite rules are securely configured and cannot be abused in such a way that they can be used to compromise internal systems.

The (1) modcache and (2) moddav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.

modproxyhttp.c in modproxyhttp in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.

Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15

moderate: modproxyajp DoS CVE-2010-0408

modproxyajp would return the wrong status code if it encountered an error causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a denial of service.

Affects: 2.2.0 - 2.2.14

Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=917876