GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Wed May 02, 2007 11:26 am Post subject: [ GLSA 200705-04 ] Apache mod_perl: Denial of Service |
|
|
Gentoo Linux Security Advisory
Title: Apache mod_perl: Denial of Service (GLSA 200705-04)
Severity: normal
Exploitable: remote
Date: May 02, 2007
Bug(s): #172676
ID: 200705-04
Synopsis
The mod_perl Apache module is vulnerable to a Denial of Service when processing regular expressions.
Background
Mod_perl is an Apache module that embeds the Perl interpreter within the server, allowing Perl-based web-applications to be created.
Affected Packages
Package: www-apache/mod_perl
Vulnerable: < 2.0.3-r1
Unaffected: >= 2.0.3-r1
Unaffected: >= 1.30 < 1.31
Architectures: All supported architectures
Description
Alex Solvey discovered that the "path_info" variable used in file RegistryCooker.pm (mod_perl 2.x) or file PerlRun.pm (mod_perl 1.x), is not properly escaped before being processed.
Impact
A remote attacker could send a specially crafted URL to the vulnerable server, possibly resulting in a massive resource consumption.
Workaround
There is no known workaround at this time.
Resolution
All mod_perl 1.x users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=www-apache/mod_perl-1.30" | All mod_perl 2.x users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=www-apache/mod_perl-2.0.3-r1" |
References
CVE-2007-1349
Last edited by GLSA on Thu May 03, 2007 4:18 am; edited 1 time in total |
|