Executive brief
A vulnerability in older versions of the Apache web server allows remote attackers to crash the service. By sending a high volume of specially crafted web requests, an attacker can overwhelm the server's memory, leading to a denial of service. This disrupts the availability of websites and web applications hosted on the affected server.
Technical details
The vulnerability is a buffer overflow within the Apache HTTP Server (version 1.2.5 and earlier). It is triggered when the server processes a high volume of GET requests that contain an unusually large number of forward slash ('/') characters. This flaw allows a remote, unauthenticated attacker to exhaust system resources or crash the daemon, resulting in a denial of service (DoS) condition. The attack is carried out over the network and does not require user interaction. Users should upgrade to a version of Apache later than 1.2.5 to mitigate this risk.
Affected products
- Apache HTTP Server 1.2.5 and earlier
Timeline
- 1997-12-30: disclosed: Vulnerability published in NVD database