Secunia

keilh has reported a vulnerability in Apache 2 mod_ssl, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL pointer dereference error in mod_ssl. This can be exploited to crash Apache via a specially crafted request.

Successful exploitation requires that the server is using the non-default worker MPM, is configured with a SSL virtual host with access control, and using a custom 400 error document.

Solution
Update to version 2.0.58 or later.

Provided and/or discovered by
keilh

Changelog
Further details available in Customer Area

Original Advisory
Apache Bugzilla:
http://issues.apache.org/bugzilla/show_bug.cgi?id=37791

Red Hat Bugzilla:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175720

Deep Links
Links available in Customer Area