Apache – CVE-2014-0226

Description

Kayran has detected that the Version of Apache HTTP Server being used is vulnerable to ‘mod_status buffer overflow’.
CVE-2014-0226 is categorized as a ‘Concurrent Execution using Shared Resource with Improper Synchronization’ vulnerability (CWE-362). A race condition was found in mod_status.

A ‘race condition’ in mod_status allow remote attackers to initiate Denial of Service (DoS) attacks through heap-based buffer overflow against your assets.
This, could also allow attackers to obtain any sensitive credential information or to execute arbitrary codes.
They do so via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c

It will lead to information being disclosed, assisting attackers in performing attacks against your assets.
It will cause a decrease in performance and interruptions in the availability of resources. There’s a chance that this vulnerability will allow attackers to modify system files and information.

Recommendation

To fix CVE-2014-0226, upgrade the version of Apache HTTP Server being used to either 2.2.29 or 2.4.10.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226

https://cwe.mitre.org/data/definitions/362.html

< Return to all Vulnerabilities

Servers 101

Let’s have a “quick” Servers 101 Course. Courtesy of Kayran! If you’ve been on the internet for over an hour, you probably already heard of

Read More »