CVE-2013-1896
CVE-2013-1896
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
EPSS 29.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log
- http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
- http://rhn.redhat.com/errata/RHSA-2013-1209.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18835
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19747
- http://support.apple.com/kb/HT6150
- http://rhn.redhat.com/errata/RHSA-2013-1156.html
- http://www.ubuntu.com/usn/USN-1903-1
- http://rhn.redhat.com/errata/RHSA-2013-1207.html
- http://www.securityfocus.com/bid/61129
- http://www.apache.org/dist/httpd/Announcement2.2.html
- http://rhn.redhat.com/errata/RHSA-2013-1208.html
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1896
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html
- http://secunia.com/advisories/55032
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2013-1896