// For flags

CVE-2012-0021

httpd: NULL pointer dereference crash in mod_log_config

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

La función log_cookie en mod_log_config.c en el módulo de mod_log_config en Apache HTTP Server v2.2.17 a v2.2.21, cuando se usa MPM multihilo , no controla correctamente una cadena de formato %{}C , lo que permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de una cookie que carece de un nombre y un valor.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-12-07 CVE Reserved
  • 2012-01-28 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-476: NULL Pointer Dereference
CAPEC
References (29)
URL Tag Source
http://secunia.com/advisories/48551 Third Party Advisory
http://support.apple.com/kb/HT5501 X_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html X_refsource_confirm
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E Mailing List
URL Date SRC
URL Date SRC
http://svn.apache.org/viewvc?view=revision&revision=1227292 2023-11-07
https://issues.apache.org/bugzilla/show_bug.cgi?id=52256 2023-11-07
URL Date SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 2023-11-07
http://httpd.apache.org/security/vulnerabilities_22.html 2023-11-07
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html 2023-11-07
http://marc.info/?l=bugtraq&m=133294460209056&w=2 2023-11-07
http://marc.info/?l=bugtraq&m=133494237717847&w=2 2023-11-07
http://rhn.redhat.com/errata/RHSA-2012-0542.html 2023-11-07
http://rhn.redhat.com/errata/RHSA-2012-0543.html 2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2012:012 2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 2023-11-07
https://bugzilla.redhat.com/show_bug.cgi?id=785065 2012-05-07
https://access.redhat.com/security/cve/CVE-2012-0021 2012-05-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.17
Search vendor "Apache" for product "Http Server" and version "2.2.17"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.18
Search vendor "Apache" for product "Http Server" and version "2.2.18"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.19
Search vendor "Apache" for product "Http Server" and version "2.2.19"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.20
Search vendor "Apache" for product "Http Server" and version "2.2.20"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.21
Search vendor "Apache" for product "Http Server" and version "2.2.21"
-
Affected