CVE-2011-3192

Impact:
Important
Public Date:
2011-08-20
Bugzilla:
732928: CVE-2011-3192 httpd: multiple ranges DoS

The MITRE CVE dictionary describes this issue as:

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Find out more about CVE-2011-3192 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

Before updated packages are deployed, users can deploy configuration changes to mitigate this flaw:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3192#c18

CVSS v2 metrics

Base Score 5
Base Metrics AV:N/AC:L/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Web Server 1.0 RHSA-2011:1330 2011-09-21
Red Hat JBoss Web Server 1.0 for RHEL 4 AS (httpd22) RHSA-2011:1329 2011-09-21
Red Hat Enterprise Linux Long Life (v. 5.3 server) (httpd) RHSA-2011:1294 2011-09-14
Red Hat Enterprise Linux 5 (httpd) RHSA-2011:1245 2011-08-31
Red Hat Enterprise Linux EUS (v. 5.6 server) RHSA-2011:1294 2011-09-14
Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server (httpd) RHSA-2011:1329 2011-09-21
Red Hat Enterprise Linux Extended Lifecycle Support 3 (httpd) RHSA-2011:1300 2011-09-15
Red Hat Enterprise Linux Server EUS (v. 6.0) (httpd) RHSA-2011:1294 2011-09-14
Red Hat Enterprise Linux 5 (httpd) RHSA-2011:1294 2011-09-14
Red Hat Enterprise Linux 6 (httpd) RHSA-2011:1245 2011-08-31
Red Hat Enterprise Linux 4 (httpd) RHSA-2011:1245 2011-08-31
Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server (httpd) RHSA-2011:1329 2011-09-21
Red Hat Application Stack v2 for Enterprise Linux (v.5) (httpd) RHSA-2011:1369 2011-10-13

Affected Packages State

Platform Package State
Red Hat Satellite Proxy 5.0 rhn-apache Not affected
Red Hat Satellite 5.0 rhn-apache Not affected
Red Hat Directory Server 8 httpd Affected
Red Hat Certificate System 7.3 for 4AS httpd Affected

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.