CVE-2011-3192 Information

Share on:
Feb 14, 2021 cve

Description

The byterange filter in the Apache HTTP Server 1.3.x 2.0.x through 2.0.64 and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges as exploited in the wild in August 2011 a different vulnerability than CVE-2007-0086.

Reference

http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html http://blogs.oracle.com/security/entry/security_alert_for_cve_2011 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/[email protected] http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com3e http://marc.info/?l=bugtraq&m=131551295528105&w=2 http://marc.info/?l=bugtraq&m=131731002122529&w=2 http://marc.info/?l=bugtraq&m=132033751509019&w=2 http://marc.info/?l=bugtraq&m=133477473521382&w=2 http://marc.info/?l=bugtraq&m=133951357207000&w=2 http://marc.info/?l=bugtraq&m=134987041210674&w=2 http://osvdb.org/74721 http://seclists.org/fulldisclosure/2011/Aug/175 http://secunia.com/advisories/45606 http://secunia.com/advisories/45937 http://secunia.com/advisories/46000 http://secunia.com/advisories/46125 http://secunia.com/advisories/46126 http://securitytracker.com/id?1025960 http://support.apple.com/kb/HT5002 http://www.apache.org/dist/httpd/Announcement2.2.html http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml http://www.exploit-db.com/exploits/17696 http://www.gossamer-threads.com/lists/apache/dev/401638 http://www.kb.cert.org/vuls/id/405811 http://www.mandriva.com/security/advisories?name=MDVSA-2011:130 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html http://www.redhat.com/support/errata/RHSA-2011-1245.html http://www.redhat.com/support/errata/RHSA-2011-1294.html http://www.redhat.com/support/errata/RHSA-2011-1300.html http://www.redhat.com/support/errata/RHSA-2011-1329.html http://www.redhat.com/support/errata/RHSA-2011-1330.html http://www.redhat.com/support/errata/RHSA-2011-1369.html http://www.securityfocus.com/bid/49303 http://www.ubuntu.com/usn/USN-1199-1 https://bugzilla.redhat.com/show_bug.cgi?id=732928 https://exchange.xforce.ibmcloud.com/vulnerabilities/69396 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://issues.apache.org/bugzilla/show_bug.cgi?id=51714 https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@3Ccvs.httpd.apache.org3E https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A14762 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A14824 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A18827