Tracker / CVE-2014-0226
CVE-2014-0226
Medium 6.8
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Affected products and versions
| apache | http_server · 2.2.0 → 2.2.29 |
|---|---|
| apache | http_server · 2.4.1 → 2.4.10 |
| debian | debian_linux |
| oracle | enterprise_manager_ops_center |
| oracle | http_server |
| oracle | secure_global_desktop |
| redhat | jboss_enterprise_application_platform |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.