Secunia

Two vulnerabilities have been reported in Apache httpd, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An error within the "ap_get_mime_headers_core()" function when processing headers can be exploited to consume all available memory via specially crafted, overly long header lines starting with either a TAB or SPACE character.

This vulnerability has been reported in versions 2.0.46 through 2.0.49. Prior versions may also be affected.

2) An error within the "ssl_io_filter_cleanup()" function can be exploited to cause a crash by sending a SSL request and then closing the connection down immediately.

This vulnerability has been reported in versions prior to version 2.0.50.

Solution
Update to version 2.0.50.

Provided and/or discovered by
1) Georgi Guninski
2) Hartmut Keil

Changelog
Further details available in Customer Area

Original Advisory
Apache Week:
http://www.apacheweek.com/features/security-20

Georgi Guninski:
http://www.guninski.com/httpd1.html

ASF Bugzilla:
http://issues.apache.org/bugzilla/show_bug.cgi?id=27945

Deep Links
Links available in Customer Area