National Cyber-Alert System

Vulnerability Summary for CVE-2005-2970

Overview

Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.55: http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://mail-archives.apache.org/mod_mbox/httpd-cvs/200509.mbox/%3C20051001110218.40692.qmail@minotaur.apache.org%3E

Type: Patch Information

Hyperlink:http://mail-archives.apache.org/mod_mbox/httpd-cvs/200509.mbox/%3C20051001110218.40692.qmail@minotaur.apache.org%3E

External Source: CONFIRM

Name: http://svn.apache.org/viewcvs?rev=292949&view=rev

Hyperlink:http://svn.apache.org/viewcvs?rev=292949&view=rev

External Source: CONFIRM

Name: http://svn.apache.org/viewcvs?rev=292949&view=rev

Type: Advisory

Hyperlink:http://svn.apache.org/viewcvs?rev=292949&view=rev

External Source: UBUNTU

Name: USN-225-1

Hyperlink:http://www.ubuntulinux.org/usn/usn-225-1/document_view

External Source: BID

Name: 15762

Hyperlink:http://www.securityfocus.com/bid/15762

External Source: FEDORA

Name: FLSA-2006:175406

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/425399/100/0/threaded

External Source: FEDORA

Name: FEDORA-2006-052

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00060.html

External Source: SUSE

Name: SUSE-SR:2005:028

Hyperlink:http://www.novell.com/linux/security/advisories/2005_28_sr.html

External Source: MANDRIVA

Name: MDKSA-2005:233

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:233

External Source: SECTRACK

Name: 1015093

Hyperlink:http://securitytracker.com/id?1015093

External Source: SECUNIA

Name: 18585

Hyperlink:http://secunia.com/advisories/18585

External Source: SECUNIA

Name: 18333

Hyperlink:http://secunia.com/advisories/18333

External Source: SECUNIA

Name: 18161

Hyperlink:http://secunia.com/advisories/18161

External Source: SECUNIA

Name: 17923

Hyperlink:http://secunia.com/advisories/17923

External Source: SECUNIA

Name: 16559

Hyperlink:http://secunia.com/advisories/16559

External Source: REDHAT

Name: RHSA-2006:0159

Hyperlink:http://rhn.redhat.com/errata/RHSA-2006-0159.html

External Source: MANDRIVA

Name: MDKSA-2005:233

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2005:233