CVE-2013-4352

La función cache_invalidate en modules/cache/cache_storage.c en el módulo mod_cache en Apache HTTP Server 2.4.6, cuando un proxy del cacheo de reenvíos está habilitado, permite a servidores HTTP remotos causar una denegación de servicio (referencia a puntero nulo y caída del demonio) a través de vectores que provocan un valor de nombre de anfitrión ausente.

A NULL pointer dereference flaw was found in the mod_cache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user. A NULL pointer dereference flaw was found in the mod_cache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching.