// For flags

CVE-2007-6422

httpd mod_proxy_balancer crash

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.

La función balancer_handler en el componente mod_proxy_balancer en el servidor HTTP de Apache versión 2.2.0 hasta 2.2.6, cuando se utiliza un módulo de procesamiento múltiple enhebrado, permite a los usuarios autenticados remotos causar una denegación de servicio (bloqueo del proceso secundario) por medio de una variable bb no válida.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-12-17 CVE Reserved
  • 2008-01-08 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-399: Resource Management Errors
CAPEC
References (35)
URL Tag Source
http://httpd.apache.org/security/vulnerabilities_22.html X_refsource_confirm
http://securityreason.com/securityalert/3523 Third Party Advisory
http://www.securityfocus.com/archive/1/486169/100/0/threaded Mailing List
http://www.securityfocus.com/bid/27236 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39476 Vdb Entry
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10181 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8690 Signature
URL Date SRC
URL Date SRC
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html 2023-11-07
http://secunia.com/advisories/28526 2023-11-07
http://secunia.com/advisories/28749 2023-11-07
http://secunia.com/advisories/28977 2023-11-07
http://secunia.com/advisories/29348 2023-11-07
http://secunia.com/advisories/29640 2023-11-07
http://security.gentoo.org/glsa/glsa-200803-19.xml 2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2008:016 2023-11-07
http://www.redhat.com/support/errata/RHSA-2008-0008.html 2023-11-07
http://www.redhat.com/support/errata/RHSA-2008-0009.html 2023-11-07
http://www.ubuntu.com/usn/usn-575-1 2023-11-07
http://www.vupen.com/english/advisories/2008/0048 2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html 2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html 2023-11-07
https://access.redhat.com/security/cve/CVE-2007-6422 2008-01-21
https://bugzilla.redhat.com/show_bug.cgi?id=427230 2008-01-21
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
--
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2
Search vendor "Apache" for product "Http Server" and version "2.2"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.1
Search vendor "Apache" for product "Http Server" and version "2.2.1"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.2
Search vendor "Apache" for product "Http Server" and version "2.2.2"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.3
Search vendor "Apache" for product "Http Server" and version "2.2.3"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.4
Search vendor "Apache" for product "Http Server" and version "2.2.4"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.6
Search vendor "Apache" for product "Http Server" and version "2.2.6"
-
Affected