FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-0021

This CVE name corresponds to:

Entered Topic
2012-01-31 apache -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2012-0021
Phase Assigned(20111207)

Description

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

References

Source Reference
CONFIRM http://httpd.apache.org/security/vulnerabilities_22.html
CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1227292
CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=785065
CONFIRM https://issues.apache.org/bugzilla/show_bug.cgi?id=52256
CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
CONFIRM http://support.apple.com/kb/HT5501
APPLE APPLE-SA-2012-09-19-2
HP HPSBMU02786
HP SSRT100877
MANDRIVA MDVSA-2013:150
SECUNIA 48551