Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache HTTP Server ‘server/util.c’ 输入验证漏洞
Vulnerability Description
Apache HTTP Server是美国阿帕奇（Apache）软件基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.0.x版本至2.0.64版本以及2.2.x版本至2.2.21版本中存在漏洞。由于server/util.c的ap_pregsub函数在启用mod_setenvif模块时不能限制环境变量值的大小，本地用户可通过带有特制SetEnvIf指示符的.htaccess文件导致拒绝服务（内存消耗或者空指针解引用）。
CVSS Information
N/A
Vulnerability Type
N/A