CVE-2014-0117

What it actually does

The mod_proxy module in Apache HTTP Server crashes child processes when a reverse proxy configuration processes a specially crafted Connection HTTP header.

Why it matters to the business

Service availability is disrupted through repeated process crashes on servers acting as reverse proxies, potentially affecting downstream applications that rely on the proxy layer.

How an attack unfolds

An attacker sends an HTTP request containing a malformed Connection header directly to a server configured with mod_proxy in reverse-proxy mode; the server parses the header, triggers a flaw in input handling, and terminates the handling child process.

How to fix it

Upgrade Apache HTTP Server 2.4.x installations to version 2.4.10 or later; if an upgrade is not immediately possible, disable reverse-proxy functionality or apply available vendor patches.

How to confirm the fix worked

Confirm the installed Apache version is 2.4.10 or newer; in a test environment, replay a request containing the crafted Connection header and verify the child process no longer crashes.

Typical attack path

1. Identify publicly reachable Apache servers with reverse-proxy functionality enabled
2. Craft an HTTP request containing a malicious Connection header
3. Send the request to the target proxy endpoint
4. Observe child-process termination and service degradation

How to detect it

Inspect Apache error logs for repeated child-process crash entries associated with mod_proxy around the time of suspected incidents; correlate with unusual Connection header values in access logs.

What your security team should do

• Prioritize upgrade of all internet-facing Apache 2.4.x instances to 2.4.10 or later
• Review and disable reverse-proxy configurations where not required
• Enable logging of Connection headers for anomaly detection during the upgrade window