CVE-2008-2364

Publication date 13 June 2008

Last updated 24 July 2024

The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
apache2	8.10 intrepid	Fixed 2.2.9-1
	8.04 LTS hardy	Fixed 2.2.8-1ubuntu0.4
	7.10 gutsy	Fixed 2.2.4-3ubuntu0.2
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Fixed 2.0.55-4ubuntu2.4

Notes

kees

only a problem when the server being proxied is untrusted

jdstrand

PoC: http://svn.apache.org/viewvc/httpd/test/framework/trunk/t/security/CVE-2008-2364.t?revision=666283&view=markup

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154 Upstream: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666180 Other: http://archive.apache.org/dist/httpd/patches/apply_to_2.0.63/CVE-2008-2364-patch-2.0.txt Debdiff: http://launchpad.net/bugs/239894

CVE-2008-2364

Status

Notes

kees

jdstrand

Patch details

References

Related Ubuntu Security Notices (USN)

Other references