4.3 - CVE-2014-0117

Executive Summary

Informations
Name	CVE-2014-0117	First vendor Publication	2014-07-20
Vendor	Cve	Last vendor Modification	2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0117

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27351

Oval ID:	oval:org.mitre.oval:def:27351
Title:	ELSA-2014-0921 -- httpd security update (important)
Description:	[2.4.6-18.0.1.el7_0] - replace index.html with Oracle's index page oracle_index.html [2.4.6-18] - mod_cgid: add security fix for CVE-2014-0231 (#1120607) - mod_proxy: add security fix for CVE-2014-0117 (#1120607) - mod_deflate: add security fix for CVE-2014-0118 (#1120607) - mod_status: add security fix for CVE-2014-0226 (#1120607) - mod_cache: add secutiry fix for CVE-2013-4352 (#1120607)
Family:	unix	Class:	patch
Reference(s):	ELSA-2014-0921 CVE-2014-0118 CVE-2014-0226 CVE-2014-0231 CVE-2013-4352 CVE-2014-0117	Version:	5
Platform(s):	Oracle Linux 7	Product(s):	httpd
Definition Synopsis:
Oracle Linux 7.x Packages match section httpd is earlier than 0:2.4.6-18.0.1.el7_0 AND httpd-devel is earlier than 0:2.4.6-18.0.1.el7_0 AND httpd-manual is earlier than 0:2.4.6-18.0.1.el7_0 AND httpd-tools is earlier than 0:2.4.6-18.0.1.el7_0 AND mod_ldap is earlier than 0:2.4.6-18.0.1.el7_0 AND mod_proxy_html is earlier than 1:2.4.6-18.0.1.el7_0 AND mod_session is earlier than 0:2.4.6-18.0.1.el7_0 AND mod_ssl is earlier than 1:2.4.6-18.0.1.el7_0

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Http Server cpe:2.3:a:apache:http_server:2.4.9:::::::* cpe:2.3:a:apache:http_server:2.4.8:::::::* cpe:2.3:a:apache:http_server:2.4.7:::::::* cpe:2.3:a:apache:http_server:2.4.6:::::::*	4
Application	Apple Mac Os X cpe:2.3:a:apple:mac_os_x:10.5.6:::::::* cpe:2.3:a:apple:mac_os_x::::::::	2
Os	Apple Mac Os X cpe:2.3:o:apple:mac_os_x:10.9.5:::::::* cpe:2.3:o:apple:mac_os_x:10.9.4:::::::* cpe:2.3:o:apple:mac_os_x:10.9.3:::::::* cpe:2.3:o:apple:mac_os_x:10.9.2:::::::* cpe:2.3:o:apple:mac_os_x:10.9.1:::::::* cpe:2.3:o:apple:mac_os_x:10.9:::::::* cpe:2.3:o:apple:mac_os_x:10.8.5:::::::* cpe:2.3:o:apple:mac_os_x:10.8.5:supplemental_update:::::: cpe:2.3:o:apple:mac_os_x:10.8.4:::::::* cpe:2.3:o:apple:mac_os_x:10.8.3:::::::* cpe:2.3:o:apple:mac_os_x:10.8.2:::::::* cpe:2.3:o:apple:mac_os_x:10.8.1:::::::* cpe:2.3:o:apple:mac_os_x:10.8.0:::::::* cpe:2.3:o:apple:mac_os_x:10.7.5:::::::* cpe:2.3:o:apple:mac_os_x:10.7.4:::::::* cpe:2.3:o:apple:mac_os_x:10.7.3:::::::* cpe:2.3:o:apple:mac_os_x:10.7.2:::::::* cpe:2.3:o:apple:mac_os_x:10.7.1:::::::* cpe:2.3:o:apple:mac_os_x:10.7.0:::::::* cpe:2.3:o:apple:mac_os_x:10.6.9:::::::* cpe:2.3:o:apple:mac_os_x:10.6.8:::::::* cpe:2.3:o:apple:mac_os_x:10.6.7:::::::* cpe:2.3:o:apple:mac_os_x:10.6.6:::::::* cpe:2.3:o:apple:mac_os_x:10.6.5:::::::* cpe:2.3:o:apple:mac_os_x:10.6.4:::::::* cpe:2.3:o:apple:mac_os_x:10.6.3:::::::* cpe:2.3:o:apple:mac_os_x:10.6.2:::::::* cpe:2.3:o:apple:mac_os_x:10.6.1:::::::* cpe:2.3:o:apple:mac_os_x:10.6.1::server::::: cpe:2.3:o:apple:mac_os_x:10.6.0:::::::* cpe:2.3:o:apple:mac_os_x:10.6:::::::* cpe:2.3:o:apple:mac_os_x:10.6:server:::::: cpe:2.3:o:apple:mac_os_x:10.5.8:::::::* cpe:2.3:o:apple:mac_os_x:10.5.8::server::::: cpe:2.3:o:apple:mac_os_x:10.5.7:::::::* cpe:2.3:o:apple:mac_os_x:10.5.6:::::::* cpe:2.3:o:apple:mac_os_x:10.5.5:::::::* cpe:2.3:o:apple:mac_os_x:10.5.4:::::::* cpe:2.3:o:apple:mac_os_x:10.5.3:::::::* cpe:2.3:o:apple:mac_os_x:10.5.2:::::::* cpe:2.3:o:apple:mac_os_x:10.5.2:2008-002:::::: cpe:2.3:o:apple:mac_os_x:10.5.1:::::::* cpe:2.3:o:apple:mac_os_x:10.5.0:::::::* cpe:2.3:o:apple:mac_os_x:10.5:::::::* cpe:2.3:o:apple:mac_os_x:10.4.9:::::::* cpe:2.3:o:apple:mac_os_x:10.4.8:::::::* cpe:2.3:o:apple:mac_os_x:10.4.8::macbook::::: cpe:2.3:o:apple:mac_os_x:10.4.8::mac_mini::::: cpe:2.3:o:apple:mac_os_x:10.4.8::macbook_pro::::: cpe:2.3:o:apple:mac_os_x:10.4.7:::::::* cpe:2.3:o:apple:mac_os_x:10.4.6:::::::* cpe:2.3:o:apple:mac_os_x:10.4.5:::::::* cpe:2.3:o:apple:mac_os_x:10.4.4:::::::* cpe:2.3:o:apple:mac_os_x:10.4.3:::::::* cpe:2.3:o:apple:mac_os_x:10.4.2:::::::* cpe:2.3:o:apple:mac_os_x:10.4.11:::::::* cpe:2.3:o:apple:mac_os_x:10.4.10:::::::* cpe:2.3:o:apple:mac_os_x:10.4.1:::::::* cpe:2.3:o:apple:mac_os_x:10.4.0:::::::* cpe:2.3:o:apple:mac_os_x:10.4.:::::::* cpe:2.3:o:apple:mac_os_x:10.4:::::::* cpe:2.3:o:apple:mac_os_x:10.3.9:::::::* cpe:2.3:o:apple:mac_os_x:10.3.8:::::::* cpe:2.3:o:apple:mac_os_x:10.3.7:::::::* cpe:2.3:o:apple:mac_os_x:10.3.6:::::::* cpe:2.3:o:apple:mac_os_x:10.3.5:::::::* cpe:2.3:o:apple:mac_os_x:10.3.4:::::::* cpe:2.3:o:apple:mac_os_x:10.3.3:::::::* cpe:2.3:o:apple:mac_os_x:10.3.2:::::::* cpe:2.3:o:apple:mac_os_x:10.3.1:::::::* cpe:2.3:o:apple:mac_os_x:10.3.0:::::::* cpe:2.3:o:apple:mac_os_x:10.3:::::::* cpe:2.3:o:apple:mac_os_x:10.2.8:::::::* cpe:2.3:o:apple:mac_os_x:10.2.7:::::::* cpe:2.3:o:apple:mac_os_x:10.2.6:::::::* cpe:2.3:o:apple:mac_os_x:10.2.5:::::::* cpe:2.3:o:apple:mac_os_x:10.2.4:::::::* cpe:2.3:o:apple:mac_os_x:10.2.3:::::::* cpe:2.3:o:apple:mac_os_x:10.2.2:::::::* cpe:2.3:o:apple:mac_os_x:10.2.1:::::::* cpe:2.3:o:apple:mac_os_x:10.2.0:::::::* cpe:2.3:o:apple:mac_os_x:10.2:::::::* cpe:2.3:o:apple:mac_os_x:10.10.2:::::::* cpe:2.3:o:apple:mac_os_x:10.10.1:::::::* cpe:2.3:o:apple:mac_os_x:10.10.0:::::::* cpe:2.3:o:apple:mac_os_x:10.1.5:::::::* cpe:2.3:o:apple:mac_os_x:10.1.4:::::::* cpe:2.3:o:apple:mac_os_x:10.1.3:::::::* cpe:2.3:o:apple:mac_os_x:10.1.2:::::::* cpe:2.3:o:apple:mac_os_x:10.1.1:::::::* cpe:2.3:o:apple:mac_os_x:10.1.0:::::::* cpe:2.3:o:apple:mac_os_x:10.1:::::::* cpe:2.3:o:apple:mac_os_x:10.0.4:::::::* cpe:2.3:o:apple:mac_os_x:10.0.3:::::::* cpe:2.3:o:apple:mac_os_x:10.0.2:::::::* cpe:2.3:o:apple:mac_os_x:10.0.1:::::::* cpe:2.3:o:apple:mac_os_x:10.0.0:::::::* cpe:2.3:o:apple:mac_os_x:10.0:::::::* cpe:2.3:o:apple:mac_os_x:::::::: cpe:2.3:o:apple:mac_os_x:-:::::::*	100

Information Assurance Vulnerability Management (IAVM)

Date	Description
2014-07-24	IAVM : 2014-A-0114 - Multiple Vulnerabilities in Apache HTTP Server Severity : Category I - VMSKEY : V0053307

Snort® IPS/IDS

Date	Description
2015-08-20	Apache HTTP Server mod_proxy denial of service attempt RuleID : 35314 - Revision : 3 - Type : SERVER-APACHE

Nessus® Vulnerability Scanner

Date	Description
2015-04-10	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_10_3.nasl - Type : ACT_GATHER_INFO
2015-04-10	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_SecUpd2015-004.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-093.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_apache_20141014.nasl - Type : ACT_GATHER_INFO
2014-08-21	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-503.nasl - Type : ACT_GATHER_INFO
2014-08-15	Name : The remote Fedora host is missing a security update. File : fedora_2014-9057.nasl - Type : ACT_GATHER_INFO
2014-07-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0921.nasl - Type : ACT_GATHER_INFO
2014-07-26	Name : The remote Fedora host is missing a security update. File : fedora_2014-8742.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-204-01.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0921.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0921.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2299-1.nasl - Type : ACT_GATHER_INFO
2014-07-21	Name : The remote web server may be affected by multiple vulnerabilities. File : apache_2_4_10.nasl - Type : ACT_GATHER_INFO
2014-07-21	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_4364e1f10f4411e4b09020cf30e32f6d.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
CONFIRM	http://advisories.mageia.org/MGASA-2014-0305.html http://httpd.apache.org/security/vulnerabilities_24.html http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c... http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=... http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html https://bugzilla.redhat.com/show_bug.cgi?id=1120599 https://support.apple.com/HT204659
FULLDISC	http://seclists.org/fulldisclosure/2014/Jul/117
MISC	http://zerodayinitiative.com/advisories/ZDI-14-239/

Alert History

If you want to see full details history, please login or register.

Date	Informations
2023-11-07 21:45:24	Multiple Updates
2021-06-06 17:23:01	Multiple Updates
2021-05-04 12:31:49	Multiple Updates
2021-04-22 01:39:21	Multiple Updates
2021-03-30 17:22:49	Multiple Updates
2020-05-23 01:50:41	Multiple Updates
2020-05-23 00:39:19	Multiple Updates
2019-08-15 13:19:32	Multiple Updates
2016-09-01 01:02:04	Multiple Updates
2016-07-08 21:24:15	Multiple Updates
2016-06-17 09:27:15	Multiple Updates
2016-04-27 00:02:32	Multiple Updates
2015-08-20 21:27:33	Multiple Updates
2015-04-15 09:27:39	Multiple Updates
2015-04-14 09:27:10	Multiple Updates
2015-04-11 13:28:38	Multiple Updates
2015-04-02 09:25:43	Multiple Updates
2015-03-31 13:28:10	Multiple Updates
2015-01-22 17:22:52	Multiple Updates
2015-01-21 13:26:39	Multiple Updates
2014-09-04 13:25:07	Multiple Updates
2014-08-22 13:26:47	Multiple Updates
2014-08-16 13:27:15	Multiple Updates
2014-08-05 00:22:53	Multiple Updates
2014-07-31 13:25:04	Multiple Updates
2014-07-27 13:27:01	Multiple Updates
2014-07-26 00:20:31	Multiple Updates
2014-07-25 13:21:38	Multiple Updates
2014-07-22 13:25:06	Multiple Updates
2014-07-22 05:26:53	Multiple Updates
2014-07-20 17:21:49	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	106
Sources(s)	24
IAVM(s)	1
Snort® Rule(s)	1
Nessus® Exploit(s)	14

	Related
6.8	USN-2299-1
6.8	RHSA-2014:0922
6.8	RHSA-2014:0921
6.8	MDVSA-2015:093
5.5	CVE-2020-13938
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

4.3 - CVE-2014-0117

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Information Assurance Vulnerability Management (IAVM)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU