Vulnerability Description
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.0.35, < 2.0.64 |
| Debian | Debian Linux | 4.0 |
| Fedoraproject | Fedora | 11 |
| Canonical | Ubuntu Linux | 6.06 |
| Redhat | Enterprise Linux Desktop | 5.0 |
| Redhat | Enterprise Linux Eus | 5.3 |
| Redhat | Enterprise Linux Server | 5.0 |
| Redhat | Enterprise Linux Server Aus | 5.3 |
| Redhat | Enterprise Linux Workstation | 5.0 |
Related Weaknesses (CWE)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712Exploit
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlBroken LinkMailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlMailing ListThird Party Advisory
- http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2ExploitIssue TrackingMailing List
- http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2Issue TrackingMailing ListThird Party Advisory
- http://marc.info/?l=bugtraq&m=129190899612998&w=2Issue TrackingMailing ListThird Party Advisory
- http://marc.info/?l=bugtraq&m=130497311408250&w=2Issue TrackingMailing ListThird Party Advisory
- http://osvdb.org/55782Broken Link
- http://secunia.com/advisories/35721Not ApplicableVendor Advisory
- http://secunia.com/advisories/35781Not ApplicableVendor Advisory
- http://secunia.com/advisories/35793Not ApplicableVendor Advisory
- http://secunia.com/advisories/35865Not ApplicableVendor Advisory
- http://secunia.com/advisories/37152Not ApplicableVendor Advisory
- http://secunia.com/advisories/37221Not ApplicableVendor Advisory
- http://security.gentoo.org/glsa/glsa-200907-04.xmlThird Party Advisory
FAQ
What is CVE-2009-1891?
CVE-2009-1891 is a vulnerability with a CVSS score of 7.1 (HIGH). The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denia...
How severe is CVE-2009-1891?
CVE-2009-1891 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-1891?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Debian Debian Linux, Fedoraproject Fedora, Canonical Ubuntu Linux, Redhat Enterprise Linux Desktop.