CVE-2014-0226: apache http_server

Modified

AliasesUBUNTU-CVE-2014-0226DEBIAN-CVE-2014-0226

Published 20-07-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-0226 is a medium (CVSS 6.8) vulnerability in apache http_server. EPSS estimates a 85.74% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

85.74%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 13 · Related 2

DLA-66-1 DSA-2989-1 MGASA-2014-0304 MGASA-2014-0305 OPENSUSE-SU-2024:10268-1 RHSA-2014:0920+7 more

Timeline

20-07-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

85.74%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 85.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
exploit-databasedoslinuxUnverified
Apache 2.4.7 mod_status - Scoreboard Handling Race Condition
Maturity: poc

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Oracle3 products

enterprise_manager_ops_center11.1.3 | 12.1.4
http_server10.1.3.5.0 | 11.1.1.7.0 | 12.1.2.0 | 12.1.3.0
secure_global_desktop4.63 | 4.71 | 5.0 | 5.1

Debian2 products

apache2< 2.4.10-1
debian_linuxEOL7.0 | 8.0

Apache1 product

http_server≥ 2.2.0, < 2.2.29 | ≥ 2.4.1, < 2.4.10

Redhat1 product

jboss_enterprise_application_platform6.0.0 | 6.4.0

Ubuntu1 product

apache2< 2.4.7-1ubuntu4.1

5 vendors · 8 products

References

57 links

marc.info?l=bugtraq&m=144493176821532&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
advisories.mageia.org/MGASA-2014-0305.htmlX Refsource CONFIRMThird Party Advisory
www.debian.org/security/2014/dsa-2989Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/68678VDB EntryX Refsource BIDThird Party Advisory
marc.info?l=bugtraq&m=144050155601375&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
support.apple.com/HT204659X Refsource CONFIRMThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlX Refsource CONFIRMPatchVendor Advisory
svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGESX Refsource CONFIRMVendor Advisory
svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.cX Refsource CONFIRMVendor Advisory
security.gentoo.org/glsa/glsa-201408-12.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory

Show all 57 references

security.gentoo.org/glsa/201504-03Vendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1020.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/60536Third Party AdvisoryX Refsource SECUNIANot Applicable
seclists.org/fulldisclosure/2014/Jul/114Mailing ListX Refsource FULLDISCExploitThird Party Advisory
marc.info?l=bugtraq&m=143748090628601&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
marc.info?l=bugtraq&m=143403519711434&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
zerodayinitiative.com/advisories/ZDI-14-236/X Refsource MISCThird Party AdvisoryVDB Entry
svn.apache.org/viewvc/…X Refsource CONFIRMPatchVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=1120603X Refsource CONFIRMIssue TrackingThird Party Advisory
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246X Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1021.htmlVendor AdvisoryX Refsource REDHATBroken Link
svn.apache.org/viewvc/…X Refsource CONFIRMPatchVendor Advisory
lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
www.mandriva.com/security/advisories?name=MDVSA-2014:142Vendor AdvisoryX Refsource MANDRIVABroken Link
puppet.com/security/cve/cve-2014-0226X Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1019.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
advisories.mageia.org/MGASA-2014-0304.htmlX Refsource CONFIRMThird Party Advisory
www.osvdb.org/109216VDB EntryX Refsource OSVDBBroken Link
www.exploit-db.com/exploits/34133ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.cX Refsource CONFIRMVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.povonsec.com/apache-2-4-7-exploit/X Refsource MISCBroken Link
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
ubuntu.com/security/CVE-2014-0226REPORT
ubuntu.com/security/notices/USN-2299-1Advisory
www.cve.org/CVERecord?id=CVE-2014-0226REPORT
security-tracker.debian.org/tracker/CVE-2014-0226Advisory