CVE-2011-0419
Medium
Description
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Apache Portable Runtime
PublishedMay 16, 2011
First seenMay 16, 2011
How to fix
Update
- apache portable_runtime1.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache portable_runtime | v < 1.4.3 | 1.4.3 |
| apache http_server | 2.0.0 ≤ v ≤ 2.0.65, 2.2.0 ≤ v ≤ 2.2.18 | — |
| apple mac_os_x | 10.6.0 | — |
| freebsd freebsd | No range specified | — |
| google android | No range specified | — |
| netbsd netbsd | 5.1 | — |
| openbsd openbsd | 4.8 | — |
| oracle solaris | 10 | — |
| debian debian_linux | 5.0, 6.0, 7.0 | — |
| suse linux_enterprise_server | 10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.