Apache 'mod_fcgid' Module Denial Of Service Vulnerability

Bugtraq ID:	52565
Class:	Boundary Condition Error
CVE:	CVE-2012-1181
Remote:	Yes
Local:	No
Published:	Mar 19 2012 12:00AM
Updated:	Jul 10 2012 07:10AM
Credit:	Kurt Seifried
Vulnerable:	Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apache Software Foundation mod_fcgid 2.3.6
Not Vulnerable:	Apache Software Foundation mod_fcgid 2.3.7

Apache 'mod_fcgid' Module Denial Of Service Vulnerability

The Apache 'mod_fcgid' module is prone to a denial-of-service vulnerability.

Successful exploits will result in a denial-of-service condition.

Apache 'mod_fcgid' Module Denial Of Service Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Apache 'mod_fcgid' Module Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apache 'mod_fcgid' Module Denial Of Service Vulnerability

References:

• Apache Homepage (Apache)
  
• Bug 783742 - Max Processes Per Class not honored in 2.3.6 (Greg Bowser )
  
• Bug 803918 - (CVE-2012-1181) CVE-2012-1181 mod_fcgid 2.3.6 does not respect conf (Kurt Seifried)
  
• mod_fcgid Homepage (Apache)