Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Race condition in the modstatus module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the statushandler function in modules/generators/modstatus.c and the luaapscoreboardworker function in modules/lua/luarequest.c.
Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.
Discussion and a possible patch is available from the following thread:
http://marc.info/?t=138219209900002&r=1&w=2
References:
http://martin.swende.se/blog/HTTPChunked.html
The davxmlgetcdata function in main/util.c in the moddav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
It was found that modrewrite writes data to a log file without sanitizing non-printable characters. A remote attacker could use this flaw to write terminal escape sequences to log files (if the RewriteLog directive was used by modrewrite). This could possibly cause arbitrary command execution, via HTTP requests containing an escape sequence for a terminal emulator. (if for example the log files were viewed in a terminal emulator)
Reference: http://svn.apache.org/viewvc?view=revision&revision=r1469311
Proposed patch: http://people.apache.org/~jorton/modrewrite-CVE-2013-1862.patch
A new attack was discovered against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions.
Reference:
http://www.isg.rhul.ac.uk/tls/ http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html