CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
all versions through 2.2.33 and 2.4.26
Description:
The value placeholder in [Proxy-]Authorization headers
of type 'Digest' was not initialized or
CVE-2017-9789: Read after free in mod_http2.c
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
httpd 2.4.26
Description:
When under stress, closing many connections, the HTTP/2
handling code would sometimes access memory after it has
been freed, resulting in
Apache HTTP Server 2.2.22 Released
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to announce the release of version 2.2.22 of the Apache HTTP
Server (Apache). This version of Apache is principally a security
and bug fix release,
Vulnerability; httpd Timeout detection flaw (mod_proxy_http) CVE-2010-2068
Classification; important
Description;
A timeout detection flaw in the httpd mod_proxy_http module causes
proxied response to be sent as the response to a different request,
and potentially served to a
Runtime UTF-8 Decoder Smuggling Vector
Discovered by: William A. Rowe, Jr. wr...@rowe-clan.net
Sr. Software Engineer, SpringSource, Inc.
Security Team member, Apache Software Foundation
Based on Tomcat Path Traversal Flaw reported by OuTian[1] and Simon Ryeo[2
Steven M. Christey wrote:
CVE requests can be sent to [EMAIL PROTECTED] or to me directly. My PGP
key is below, or accessible from the MIT public key server.
Alternately, you can request them from Candidate Numbering Authorities
(CNAs) which include the security teams at Red Hat, Microsoft, and
Abe Getchell wrote:
When the security option Shutdown: Allow system to be shutdown without
having to log on (in the local security policy) is set to Disable, and
the power management setting When I press the power button is set to Shut
Down, it is possible for an unauthenticated user to press
William A. Rowe, Jr. wrote:
With respect to http://www.securityfocus.com/bid/29112
All releases after Jan 2 include fixes across the board to add an explicit
charset iso-8859-1 to the built in Apache HTTP modules to compensate for
Microsoft's vulnerability, including released versions 2.2.8
[EMAIL PROTECTED] wrote:
Dear Bill From Apache
I think that you didn't understand this vulnerability properly.
We understand it quite well; we simply disagree on the context of which
is vulnerable, the Apache server which holds to RFC2616, or IE (and Firefox
apparently in some cases) which do
HTTP User and Desktop Security Communities;
With respect to http://www.securityfocus.com/bid/29112
Per http://www.ietf.org/rfc/rfc2616.txt
3.7.1 Canonicalization and Text Defaults
[...]
The charset parameter is used with some media types to define the
character set (section 3.4) of the
3APA3A wrote:
11.10.2006Vendor response:
We believe this is not a security vulnerability but in fact a
deliberate security feature to mitigate problems with invalid data
propagating through the system.
Proving once again that MS has ordered all of it's copies of KR
Mark Litchfield wrote:
I have heard the comment It's a huge conflict of interest for one
company to provide both an operating platform and a security platform
made by John Thompson (CEO Symantec) many times from many different
people.
The only conflict that occurs to me is the commercial
bugtraq wrote:
a quick fix for this can be available at least on bsd, there is accf_http
that can be modified not to pass the connection to apache until a full request
is read (either get or post, full, not just the first get request header,
of course this can be even worst for a lot of
Michal Zalewski wrote:
I feel silly for reporting this, but I couldn't help but notice that
Apache and IIS both have a bizarro implementation of HTTP/1.1 Range
header functionality (as defined by RFC 2616). Their implementations allow
the same fragment of a file to be requested an arbitrary
Michal Zalewski wrote:
On Wed, 3 Jan 2007, William A. Rowe, Jr. wrote:
If you have an issue with this behavior, of HTTP, then you have an issue
with the behavior under FTP or a host of other protocols.
Not really; see above. These are typically well known, preventable by
configuring
Philip M. Gollucci wrote:
William A. Rowe, Jr. wrote:
Apache HTTP Server 2.2.3 Released
...
CVE-2006-3747: An off-by-one flaw exists in the Rewrite module,
mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0 since 2.0.46,
and 2.2 since 2.2.0.
Is a release
At 04:34 AM 7/29/2003, Michael Shigorin wrote:
On Tue, Jul 22, 2003 at 05:30:39PM -0500, William A. Rowe, Jr. wrote:
As described in the default configuration, open proxies are never
recommended [from Apache 1.3.27 conf/httpd.conf-dist];
[skip]
#Allow from .your-domain.com
The Security Team responded 13 minutes after Jason's initial report,
attempting to explain how he had misconfigured his server. While we
acknowledge that new directives might be desirable in limited cases,
the team determined that this is clearly a user configuration error.
The Apache HTTP
At 12:01 PM 8/16/2002, Auriemma Luigi wrote:
B) CAN-2002-0661
The problem is in the management of the bad chars that can be used to
launch some attacks, such as the directory traversal. In fact the
backslash char ('\' == %5c) is not checked as a bad char, so it can be
used for
19 matches
Mail list logo
