Kingcope has discovered a vulnerability in Apache HTTP Server, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the ByteRange filter when processing requests containing a large amount of ranges, which can be exploited to exhaust memory via specially crafted HTTP requests sent to the server.

The vulnerability is confirmed in version 2.2.19. Other versions may also be affected.

Solution
Update to version 2.2.21, which fixes a regression introduced in version 2.2.20. For Apache HTTP Server 2.0.x, apply patches or update to version 2.0.65 when available.
Further details available in Customer Area

Provided and/or discovered by
Kingcope

Changelog
Further details available in Customer Area

Original Advisory
Apache:
http://httpd.apache.org/security/vulnerabilities_22.html#2.2.20
http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110824161640.122D387DD@minotaur.apache.org%3E
http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110826103531.998348F82@minotaur.apache.org%3E
http://httpd.apache.org/security/CVE-2011-3192.txt

Kingcope:
http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0203.html
https://issues.apache.org/bugzilla/show_bug.cgi?id=51714

http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3Calpine.DEB.2.00.1108231306230.24177@eru.sfritsch.de%3E

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area