Two vulnerabilities have been reported in Apache, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An error exists in mod_proxy_ftp when processing responses received from FTP servers. This can be exploited to trigger a NULL-pointer dereference and crash an Apache child process via a malformed EPSV response.

Successful exploitation requires that a threaded Multi-Processing Module is used and that the mod_proxy_ftp module is enabled.

The vulnerability is confirmed in Apache versions 2.0.63 and 2.2.13. Other versions may also be affected.

2) An error in the included APR-util library can be exploited to trigger hangs in the prefork and event MPMs on Solaris.

For more information see vulnerability #2 in:
SA36138

The vulnerability is reported in 2.2.x versions prior to 2.2.14.

Solution
Apache 2.2.x:
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Evgeny Legerov

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apache Foundation:
http://httpd.apache.org/security/vulnerabilities_22.html
http://httpd.apache.org/security/vulnerabilities_20.html
http://www.apache.org/dist/httpd/CHANGES_2.0.64

Intevydis:
http://www.intevydis.com/blog/?p=59

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers