CVE-2014-0226
published 2014-07-20CVE-2014-0226: Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer…
PriorityP267medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
85.74%
99.7th percentile
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.2.0 < 2.2.29 | 2.2.29 |
| apache | http_server | >= 2.4.1 < 2.4.10 | 2.4.10 |
| apple | os_x_yosemite_v10.10.3_and_security_update_2015-004 | — | — |
| debian | apache2 | < apache2 2.4.10-1 (bookworm) | apache2 2.4.10-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | secure_global_desktop | — | — |
| oracle | secure_global_desktop | — | — |
| oracle | secure_global_desktop | — | — |
| oracle | secure_global_desktop | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only triggerable when mod_status is enabled with SetHandler server-status and ExtendedStatus On in httpd.conf — confirm this configuration is present before investigating exploitation ↗
- →Exploitation requires Apache compiled with MPM event or MPM worker (threaded MPM); servers using prefork MPM are not affected ↗
- →The race condition is triggered by two concurrent clients: one repeatedly hitting the mod_status handler (server-status endpoint) and a second sending arbitrary requests to the web server — look for high-frequency parallel requests to the server-status URL alongside normal traffic ↗
- →The race condition manifests in ap_escape_logitem (server/util.c) and ap_escape_html2 when processing ws_record->request from the scoreboard; a heap buffer overflow or information leak results — monitor for httpd child process crashes (SIGSEGV/SIGABRT) correlated with server-status requests ↗
- →The write-side of the race originates in update_child_status_internal (scoreboard.c); thread-sanitizer (tsan) output shows the conflicting access at ap_escape_logitem -> status_handler and update_child_status_internal — use tsan-instrumented builds or heap-corruption detectors (ASan) to confirm exploitation attempts in test environments ↗
- →Information leakage scenario: the non-null-terminated string returned by ap_escape_logitem may expose heap contents including htaccess credentials and SSL private key material in the server-status HTML response — inspect server-status output for unexpected binary or credential-like data ↗
- →Affected Apache versions are before 2.4.10; verify the running httpd version — 2.4.7 is explicitly confirmed vulnerable ↗
- ·The vulnerability is only exploitable when mod_status is actively configured with SetHandler server-status; if mod_status is not enabled or the server-status endpoint is not accessible to remote attackers, the attack surface does not exist ↗
- ·Only threaded MPMs (event, worker) are affected; prefork MPM is not vulnerable because the race condition requires concurrent threads sharing the scoreboard ↗
- ·Red Hat JBoss Enterprise Application Platform 5 is listed as Not affected; Red Hat JBoss Enterprise Web Server 1 will not be fixed — scope detection rules accordingly ↗
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
vendor_ubuntu4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9c3m-phm4-whxx: Race condition in the mod_status module in the Apache HTTP Server before 2
ghsa_unreviewed·2022-05-13
CVE-2014-0226 [MEDIUM] CWE-362 GHSA-9c3m-phm4-whxx: Race condition in the mod_status module in the Apache HTTP Server before 2
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
OSV
apache2 vulnerabilities
osv·2014-07-23·CVSS 4.3
CVE-2014-0117 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Marek Kroemeke discovered that the mod_proxy module incorrectly handled
certain requests. A remote attacker could use this issue to cause the
server to stop responding, leading to a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2014-0117)
Giancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate
module incorrectly handled body decompression. A remote attacker could use
this issue to cause resource consumption, leading to a denial of service.
(CVE-2014-0118)
Marek Kroemeke and others discovered that the mod_status module incorrectly
handled certain requests. A remote attacker could use this issue to cause
the server to stop responding, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2014-0226)
Rainer
OSV
CVE-2014-0226: Race condition in the mod_status module in the Apache HTTP Server before 2
osv·2014-07-20·CVSS 6.8
CVE-2014-0226 [MEDIUM] CVE-2014-0226: Race condition in the mod_status module in the Apache HTTP Server before 2
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2014-07-23·CVSS 4.3
CVE-2014-0117 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Marek Kroemeke discovered that the mod_proxy module incorrectly handled
certain requests. A remote attacker could use this issue to cause the
server to stop responding, leading to a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2014-0117)
Giancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate
module incorrectly handled body decompression. A remote attacker could use
this issue to cause resource consumption, leading to a denial of service.
(CVE-2014-0118)
Marek Kroemeke and others discovered that the mod_status module incorrectly
handled certain requests. A remote attacker could use this issue to cause
the server to stop responding, leadin
Red Hat
httpd: mod_status heap-based buffer overflow
vendor_redhat·2014-07-17·CVSS 6.8
CVE-2014-0226 [MEDIUM] CWE-662 httpd: mod_status heap-based buffer overflow
httpd: mod_status heap-based buffer overflow
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child
Debian
CVE-2014-0226: apache2 - Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 ...
vendor_debian·2014·CVSS 6.8
CVE-2014-0226 [MEDIUM] CVE-2014-0226: apache2 - Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 ...
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Scope: local
bookworm: resolved (fixed in 2.4.10-1)
bullseye: resolved (fixed in 2.4.10-1)
forky: resolved (fixed in 2.4.10-1)
sid: resolved (fixed in 2.4.10-1)
trixie: resolved (fixed in 2.4.10-1)
Apple
CVE-2014-0226: OS X Yosemite v10.10.3 and Security Update 2015-004
vendor_apple·CVSS 6.8
CVE-2014-0226 [MEDIUM] CVE-2014-0226: OS X Yosemite v10.10.3 and Security Update 2015-004
Apple Security Update: About the security content of OS X Yosemite v10.10.3 and Security Update 2015-004
Product: OS X Yosemite v10.10.3 and Security Update 2015-004
CVE: CVE-2014-0226
Component: CVE-2014-0226
No detection rules found.
Bugzilla
CVE-2014-0231 CVE-2014-0118 CVE-2014-0117 CVE-2014-0226 CVE-2013-4352 httpd: various flaws [fedora-all]
bugzilla·2014-07-17·CVSS 4.3
CVE-2014-0231 [MEDIUM] CVE-2014-0231 CVE-2014-0118 CVE-2014-0117 CVE-2014-0226 CVE-2013-4352 httpd: various flaws [fedora-all]
CVE-2014-0231 CVE-2014-0118 CVE-2014-0117 CVE-2014-0226 CVE-2013-4352 httpd: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: th
Bugzilla
CVE-2014-0226 httpd: mod_status heap-based buffer overflow
bugzilla·2014-07-17·CVSS 6.8
CVE-2014-0226 [MEDIUM] CVE-2014-0226 httpd: mod_status heap-based buffer overflow
CVE-2014-0226 httpd: mod_status heap-based buffer overflow
The following flaw has been fixed in the Apache HTTP Server:
"A race condition was found in mod_status. An attacker able to access a public server status page on a server using a threaded MPM could send a carefully crafted request which could lead to a heap buffer overflow. Note that it is not a default or recommended configuration to have a public accessible server status page."
External References:
http://httpd.apache.org/security/vulnerabilities_24.html
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1120614]
---
Upstream commit:
http://svn.apache.org/viewvc?view=revision&revision=1610491
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Red Hat Enter
arXiv
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
arxiv_fulltext·2017-11-02
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
Zhen Huang0.25in
Mariana D'Angelo0.25in
Dhaval Miyani0.25in
David Lie
University of Toronto
\z.huang,mariana.dangelo,dhaval.miyani\@mail.utoronto.ca,[email protected]
## Abstract
There is often a considerable delay between the discovery of a vulnerability and the issue of a patch. One way to mitigate this window of vulnerability is to use a configuration workaround, which prevents the vulnerable code from being executed at the cost of some lost functionality -- but only if one is available. Since application configurations are not specifically designed to mitigate software vulnerabilities, we find that they only cover 25.2% of vulnerabilities.
To minimize patch delay vulnerabilities and address the lim
http://advisories.mageia.org/MGASA-2014-0304.htmlhttp://advisories.mageia.org/MGASA-2014-0305.htmlhttp://httpd.apache.org/security/vulnerabilities_24.htmlhttp://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlhttp://marc.info/?l=bugtraq&m=143403519711434&w=2http://marc.info/?l=bugtraq&m=143748090628601&w=2http://marc.info/?l=bugtraq&m=144050155601375&w=2http://marc.info/?l=bugtraq&m=144493176821532&w=2http://rhn.redhat.com/errata/RHSA-2014-1019.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1020.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1021.htmlhttp://seclists.org/fulldisclosure/2014/Jul/114http://secunia.com/advisories/60536http://security.gentoo.org/glsa/glsa-201408-12.xmlhttp://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGEShttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=hhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=hhttp://www.debian.org/security/2014/dsa-2989http://www.exploit-db.com/exploits/34133http://www.mandriva.com/security/advisories?name=MDVSA-2014:142http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.osvdb.org/109216http://www.securityfocus.com/bid/68678http://zerodayinitiative.com/advisories/ZDI-14-236/https://bugzilla.redhat.com/show_bug.cgi?id=1120603https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://puppet.com/security/cve/cve-2014-0226https://security.gentoo.org/glsa/201504-03https://support.apple.com/HT204659https://www.povonsec.com/apache-2-4-7-exploit/http://advisories.mageia.org/MGASA-2014-0304.htmlhttp://advisories.mageia.org/MGASA-2014-0305.htmlhttp://httpd.apache.org/security/vulnerabilities_24.htmlhttp://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlhttp://marc.info/?l=bugtraq&m=143403519711434&w=2http://marc.info/?l=bugtraq&m=143748090628601&w=2http://marc.info/?l=bugtraq&m=144050155601375&w=2http://marc.info/?l=bugtraq&m=144493176821532&w=2http://rhn.redhat.com/errata/RHSA-2014-1019.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1020.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1021.htmlhttp://seclists.org/fulldisclosure/2014/Jul/114http://secunia.com/advisories/60536http://security.gentoo.org/glsa/glsa-201408-12.xmlhttp://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGEShttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=hhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=hhttp://www.debian.org/security/2014/dsa-2989http://www.exploit-db.com/exploits/34133http://www.mandriva.com/security/advisories?name=MDVSA-2014:142http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.osvdb.org/109216http://www.securityfocus.com/bid/68678http://zerodayinitiative.com/advisories/ZDI-14-236/https://bugzilla.redhat.com/show_bug.cgi?id=1120603https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
+ 6 more references
2014-07-20
Published