CVE-2011-4415
published 2011-11-08CVE-2011-4415: The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does…
PriorityP416low1.2CVSS 2.0
AVLACHAuNCNINAP
EXPLOIT
EPSS
3.10%
86.3th percentile
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
CVSS provenance
nvdv2.01.2LOWAV:L/AC:H/Au:N/C:N/I:N/A:P
osv4.4MEDIUM
vendor_debian4.4LOW
vendor_redhat4.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: SetEnvIf resource exhaustion
vendor_redhat·2011-11-02·CVSS 4.4
CVE-2011-4415 [MEDIUM] httpd: SetEnvIf resource exhaustion
httpd: SetEnvIf resource exhaustion
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Statement: The ASF Security Team does not consider resource exhaustion caused by .htaccess files to be a security defect. The Red Hat Security Response Team agrees with their assessment and so does not consider
Debian
CVE-2011-4415: apache2 - The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through...
vendor_debian·2011·CVSS 4.4
CVE-2011-4415 [MEDIUM] CVE-2011-4415: apache2 - The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through...
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Scope: local
bookworm: resolved (fixed in 2.4.1-1)
bullseye: resolved (fixed in 2.4.1-1)
forky: resolved (fixed in 2.4.1-1)
sid: resolved (fixed in 2.4.1-1)
trixie: resolved (fixed in 2.4.1-1)
GHSA
GHSA-43r8-mvrp-6q9c: The ap_pregsub function in server/util
ghsa_unreviewed·2022-05-17·CVSS 4.4
CVE-2011-4415 [MEDIUM] CWE-20 GHSA-43r8-mvrp-6q9c: The ap_pregsub function in server/util
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
OSV
CVE-2011-4415: The ap_pregsub function in server/util
osv·2011-11-08·CVSS 4.4
CVE-2011-4415 [MEDIUM] CVE-2011-4415: The ap_pregsub function in server/util
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
No detection rules found.
Bugzilla
CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
bugzilla·2011-12-22·CVSS 4.4
CVE-2011-3607 [MEDIUM] CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
Vincent Danen 2011-11-02 17:14:55 EDT
It was reported [1] that an integer overflow was found in Apache in the
ap_pregsub() function called from mod-setenvif. When a header field is mangled
using SetEnvIf, the new environment variable data can be multiples of the size
of the submitted header field. This would cause ap_pregsub() to overflow the
length value in buffer size calculations, leading to the subsequent allocation
call of a too-small buffer. Filling this buffer with user-supplied data will
lead to a buffer overflow.
Depending on the input data, this can lead to excessive allocation of server
memory (resulting in killed processes due to out-of-memory conditions), invalid
memory access when copying large amounts of
Bugzilla
CVE-2011-4415 httpd: SetEnvIf resource exhaustion
bugzilla·2011-11-02·CVSS 4.4
CVE-2011-4415 [MEDIUM] CVE-2011-4415 httpd: SetEnvIf resource exhaustion
CVE-2011-4415 httpd: SetEnvIf resource exhaustion
It was reported [1] that an integer overflow was found in Apache in the ap_pregsub() function called from mod-setenvif. When a header field is mangled using SetEnvIf, the new environment variable data can be multiples of the size of the submitted header field. This would cause ap_pregsub() to overflow the length value in buffer size calculations, leading to the subsequent allocation call of a too-small buffer. Filling this buffer with user-supplied data will lead to a buffer overflow.
Depending on the input data, this can lead to excessive allocation of server memory (resulting in killed processes due to out-of-memory conditions), invalid memory access when copying large amounts of data (which can lead to a termination of the httpd proces
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041http://www.gossamer-threads.com/lists/apache/dev/403775http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.htmlhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041http://www.gossamer-threads.com/lists/apache/dev/403775http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html
2011-11-08
Published