Description
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | No fix yet | — |
| Debian 13 | apache2 | No fix yet | — |
| Debian 12 | apache2 | No fix yet | — |
References
- http://security.psnc.pl/files/apache_report.pdf
- 37050 vdb-entry
- 20070529 Apache httpd vulenrabilities mailing-list
- 2814 third-party-advisory
- 20070619 Apache Prefork MPM vulnerabilities - Report mailing-list
- 24215 vdb-entry