Executive Summary

Informations
Name CVE-2012-0021 First vendor Publication 2012-01-27
Vendor Cve Last vendor Modification 2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Cvss Base Score 2.6 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity High
Cvss Expoit Score 4.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0021

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19817
 
Oval ID: oval:org.mitre.oval:def:19817
Title: HP-UX Running Apache, Remote Denial of Service (DoS), Local Increase of Privilege
Description: The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
Family: unix Class: vulnerability
Reference(s): CVE-2012-0021
 Version: 11
Platform(s): HP-UX 11
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25484
 
Oval ID: oval:org.mitre.oval:def:25484
Title: SUSE-SU-2013:0830-1 -- Security update for Apache
Description: Apache2 has been updated to fix multiple security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0830-1
CVE-2012-4557
CVE-2012-0883
CVE-2012-2687
CVE-2012-4558
CVE-2012-3499
CVE-2011-3368
CVE-2011-4317
CVE-2012-0021
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
 Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25561
 
Oval ID: oval:org.mitre.oval:def:25561
Title: SUSE-SU-2013:0389-1 -- Security update for Apache
Description: This update fixes the following issues: * CVE-2012-4557: Denial of Service via special requests in mod_proxy_ajp * CVE-2012-0883: improper LD_LIBRARY_PATH handling * CVE-2012-2687: filename escaping problem
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0389-1
CVE-2012-4557
CVE-2012-0883
CVE-2012-2687
CVE-2011-3368
CVE-2011-4317
CVE-2012-0021
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
 Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26047
 
Oval ID: oval:org.mitre.oval:def:26047
Title: SUSE-SU-2013:0469-1 -- Security update for apache2
Description: This Apache2 LTSS roll-up update for SUSE Linux Enterprise 10 SP3 LTSS fixes some security issues and bugs.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0469-1
CVE-2012-4557
CVE-2012-0883
CVE-2012-2687
CVE-2012-0031
CVE-2012-0053
CVE-2007-6750
CVE-2011-3639
CVE-2011-3368
CVE-2011-4317
CVE-2011-1473
CVE-2011-3607
CVE-2012-0021
 Version: 3
Platform(s): SUSE Linux Enterprise Server 10
 Product(s): apache2
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 5

OpenVAS Exploits

Date Description
2012-09-25 Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004)
File : nvt/gb_macosx_su12-004.nasl
2012-09-10 Name : Slackware Advisory SSA:2012-041-01 httpd
File : nvt/esoft_slk_ssa_2012_041_01.nasl
2012-08-10 Name : Gentoo Security Advisory GLSA 201206-25 (apache)
File : nvt/glsa_201206_25.nasl
2012-04-02 Name : Fedora Update for httpd FEDORA-2012-1598
File : nvt/gb_fedora_2012_1598_httpd_fc16.nasl
2012-03-07 Name : Fedora Update for httpd FEDORA-2012-1642
File : nvt/gb_fedora_2012_1642_httpd_fc15.nasl
2012-02-21 Name : Ubuntu Update for apache2 USN-1368-1
File : nvt/gb_ubuntu_USN_1368_1.nasl
2012-02-12 Name : FreeBSD Ports: apache
File : nvt/freebsd_apache20.nasl
2012-02-03 Name : Mandriva Update for apache MDVSA-2012:012 (apache)
File : nvt/gb_mandriva_MDVSA_2012_012.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
78555 Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handl...

Snort® IPS/IDS

Date Description
2015-05-12 Apache mod_log_config cookie handling denial of service attempt
RuleID : 34048 - Revision : 2 - Type : SERVER-APACHE
2014-01-10 Apache mod_log_config cookie handling denial of service attempt
RuleID : 24698 - Revision : 6 - Type : SERVER-APACHE
2014-01-10 Apache mod_log_config cookie handling denial of service attempt
RuleID : 24697 - Revision : 7 - Type : SERVER-APACHE

Nessus® Vulnerability Scanner

Date Description
2017-10-31 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-2907-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2013-0469-1.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_apache_20120417.nasl - Type : ACT_GATHER_INFO
2014-12-05 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15889.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0542.nasl - Type : ACT_GATHER_INFO
2013-03-05 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_apache2-130225.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO
2012-07-05 Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_1_1_1.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-25.nasl - Type : ACT_GATHER_INFO
2012-03-07 Name : The remote Fedora host is missing a security update.
File : fedora_2012-1642.nasl - Type : ACT_GATHER_INFO
2012-02-21 Name : The remote Fedora host is missing a security update.
File : fedora_2012-1598.nasl - Type : ACT_GATHER_INFO
2012-02-17 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1368-1.nasl - Type : ACT_GATHER_INFO
2012-02-13 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2012-041-01.nasl - Type : ACT_GATHER_INFO
2012-02-03 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-012.nasl - Type : ACT_GATHER_INFO
2012-02-02 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_4b7dbfab4c6b11e1bc160023ae8e59f0.nasl - Type : ACT_GATHER_INFO
2012-02-02 Name : The remote web server is affected by multiple vulnerabilities.
File : apache_2_2_22.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5...
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360...
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4d...
https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74...
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86...
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b...
https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51...
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694...
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f...
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20...
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5...
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f...
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806ce...
Source Url
APPLE http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
CONFIRM http://httpd.apache.org/security/vulnerabilities_22.html
http://support.apple.com/kb/HT5501
http://svn.apache.org/viewvc?view=revision&revision=1227292
http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
https://bugzilla.redhat.com/show_bug.cgi?id=785065
https://issues.apache.org/bugzilla/show_bug.cgi?id=52256
HP http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://marc.info/?l=bugtraq&m=133294460209056&w=2
http://marc.info/?l=bugtraq&m=133494237717847&w=2
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2012:012
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
REDHAT http://rhn.redhat.com/errata/RHSA-2012-0542.html
http://rhn.redhat.com/errata/RHSA-2012-0543.html
SECUNIA http://secunia.com/advisories/48551

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
Date Informations
2023-11-07 21:47:05
  • Multiple Updates
2021-06-06 17:23:02
  • Multiple Updates
2021-06-03 13:23:12
  • Multiple Updates
2021-05-04 12:21:03
  • Multiple Updates
2021-04-22 01:25:10
  • Multiple Updates
2021-03-30 17:22:48
  • Multiple Updates
2020-05-23 00:32:33
  • Multiple Updates
2019-08-17 12:00:50
  • Multiple Updates
2019-03-19 12:04:48
  • Multiple Updates
2018-01-18 09:21:51
  • Multiple Updates
2018-01-09 13:22:54
  • Multiple Updates
2017-12-29 09:21:57
  • Multiple Updates
2017-11-01 13:25:10
  • Multiple Updates
2016-08-23 09:24:45
  • Multiple Updates
2016-04-26 21:22:38
  • Multiple Updates
2015-05-21 13:29:25
  • Multiple Updates
2015-05-12 21:26:37
  • Multiple Updates
2015-01-21 13:25:05
  • Multiple Updates
2014-12-06 13:26:57
  • Multiple Updates
2014-11-08 13:29:56
  • Multiple Updates
2014-02-17 11:06:47
  • Multiple Updates
2014-01-19 21:28:19
  • Multiple Updates
2013-10-11 13:23:13
  • Multiple Updates
2013-05-10 22:30:46
  • Multiple Updates