CVE-2012-1181

fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
apachemod_fcgid
2.3.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libapache2-mod-fcgid
sid
1:2.3.9-4
fixed
trixie
1:2.3.9-4
fixed
bookworm
1:2.3.9-4
fixed
bullseye
1:2.3.9-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libapache2-mod-fcgid
saucy
Fixed 1:2.3.6-1.1
released
raring
Fixed 1:2.3.6-1.1
released
quantal
Fixed 1:2.3.6-1.1
released
precise
Fixed 1:2.3.6-1.1
released
oneiric
Fixed 1:2.3.6-1+squeeze1build0.11.10.1
released
natty
Fixed 1:2.3.6-1+squeeze1build0.11.04.1
released
maverick
ignored
lucid
ignored
hardy
ignored
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814
http://www.debian.org/security/2012/dsa-2436
http://www.openwall.com/lists/oss-security/2012/03/15/10
http://www.openwall.com/lists/oss-security/2012/03/16/2
http://www.securityfocus.com/bid/52565
https://exchange.xforce.ibmcloud.com/vulnerabilities/74181
https://issues.apache.org/bugzilla/show_bug.cgi?id=49902
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814
http://www.debian.org/security/2012/dsa-2436
http://www.openwall.com/lists/oss-security/2012/03/15/10
http://www.openwall.com/lists/oss-security/2012/03/16/2
http://www.securityfocus.com/bid/52565
https://exchange.xforce.ibmcloud.com/vulnerabilities/74181
https://issues.apache.org/bugzilla/show_bug.cgi?id=49902