Out-of-bounds Read in Apache HTTP Server
CVE-2007-3847
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
Vulnerability class: Buffer Overflow
EPSS: 0.129 (95.9th percentile) — read the EPSS interpretation.
Affected products
- Apache Http_server
- Canonical Ubuntu_linux — versions 6.06, 6.10, 7.04
- Fedoraproject Fedora — versions 7
- Fedoraproject Fedora_core — versions 6
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (Permissions Required, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (signature, x_refsource_OVAL, Third Party Advisory, vdb-entry)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_AIXAPAR)
- secalert@redhat.com (x_refsource_HP, vendor-advisory, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
Frequently asked questions
- What is CVE-2007-3847?
- CVE-2007-3847 is a vulnerability in Apache HTTP Server, classified under Out-of-bounds Read. Published 2007-08-23.
- Is CVE-2007-3847 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.