CVE-2007-0086
NoneCVSS
—
EPSS
10.2%
Published
Jan 5, 2007
CISA due date
—
The record
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | apache2 | 0 | 2.4.63-r1 |
| Chainguard | apache2-compat | 0 | 2.4.63-r1 |
| Chainguard | apache2-config | 0 | 2.4.63-r1 |
| Chainguard | apache2-config-compat | 0 | 2.4.63-r1 |
| Chainguard | apache2-data | 0 | 2.4.63-r1 |
| Chainguard | apache2-dev | 0 | 2.4.63-r1 |
| Chainguard | apache2-doc | 0 | 2.4.63-r1 |
| Chainguard | apache2-oci-entrypoint | 0 | 2.4.63-r1 |
| Chainguard | apache2-utils | 0 | 2.4.63-r1 |
| Debian:10 | apache2 | 0 | No fix |
| Debian:11 | apache2 | 0 | No fix |
| Debian:12 | apache2 | 0 | No fix |
| Debian:13 | apache2 | 0 | No fix |
| Debian:14 | apache2 | 0 | No fix |
| Wolfi | apache2 | 0 | 2.4.63-r1 |
| Wolfi | apache2-compat | 0 | 2.4.63-r1 |
| Wolfi | apache2-config | 0 | 2.4.63-r1 |
| Wolfi | apache2-config-compat | 0 | 2.4.63-r1 |
| Wolfi | apache2-data | 0 | 2.4.63-r1 |
| Wolfi | apache2-dev | 0 | 2.4.63-r1 |
| Wolfi | apache2-doc | 0 | 2.4.63-r1 |
| Wolfi | apache2-oci-entrypoint | 0 | 2.4.63-r1 |
| Wolfi | apache2-utils | 0 | 2.4.63-r1 |
Related vulnerabilities
- CVE-2008-2168 Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote… Also affects apache2
- CVE-2007-0450 Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and… Also affects apache2
- CVE-1999-1412 A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows… Also affects apache2
- CVE-1999-0678 A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc… Also affects apache2
- CVE-1999-0236 ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. Also affects apache2
- CVE-2015-0228 The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP… Also affects apache2
- CVE-2014-3583 The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the… Also affects apache2
- CVE-2013-4352 The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in… Also affects apache2