CVE-2007-1349 Denial of service in n/a
Remote attackers can cause a denial of service via resource consumption by sending a crafted URI to Apache mod_perl due to improper PATH_INFO escaping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-1349?
CVE-2007-1349 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 30 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
Weakness: CWE-20
Which versions are affected by CVE-2007-1349?
It affects 7 products.
Linux distribution packages (39)
mod_perl Red Hat:enterprise_linux:2.1::as | All versions | 0:1.26-8.el2 |
mod_perl Red Hat:enterprise_linux:2.1::aw | All versions | 0:1.26-8.el2 |
mod_perl Red Hat:enterprise_linux:2.1::es | All versions | 0:1.26-8.el2 |
mod_perl Red Hat:enterprise_linux:2.1::ws | All versions | 0:1.26-8.el2 |
mod_perl Red Hat:enterprise_linux:3::as | All versions | 0:1.99_09-12.ent |
mod_perl-debuginfo Red Hat:enterprise_linux:3::as | All versions | 0:1.99_09-12.ent |
mod_perl-devel Red Hat:enterprise_linux:3::as | All versions | 0:1.99_09-12.ent |
mod_perl Red Hat:enterprise_linux:3::desktop | All versions | 0:1.99_09-12.ent |
mod_perl-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 0:1.99_09-12.ent |
mod_perl-devel Red Hat:enterprise_linux:3::desktop | All versions | 0:1.99_09-12.ent |
mod_perl Red Hat:enterprise_linux:3::es | All versions | 0:1.99_09-12.ent |
mod_perl-debuginfo Red Hat:enterprise_linux:3::es | All versions | 0:1.99_09-12.ent |
mod_perl-devel Red Hat:enterprise_linux:3::es | All versions | 0:1.99_09-12.ent |
mod_perl Red Hat:enterprise_linux:3::ws | All versions | 0:1.99_09-12.ent |
mod_perl-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 0:1.99_09-12.ent |
mod_perl-devel Red Hat:enterprise_linux:3::ws | All versions | 0:1.99_09-12.ent |
mod_perl Red Hat:enterprise_linux:4::as | All versions | 0:1.99_16-4.5 |
mod_perl-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:1.99_16-4.5 |
mod_perl-devel Red Hat:enterprise_linux:4::as | All versions | 0:1.99_16-4.5 |
mod_perl Red Hat:enterprise_linux:4::desktop | All versions | 0:1.99_16-4.5 |
mod_perl-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:1.99_16-4.5 |
mod_perl-devel Red Hat:enterprise_linux:4::desktop | All versions | 0:1.99_16-4.5 |
mod_perl Red Hat:enterprise_linux:4::es | All versions | 0:1.99_16-4.5 |
mod_perl-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:1.99_16-4.5 |
mod_perl-devel Red Hat:enterprise_linux:4::es | All versions | 0:1.99_16-4.5 |
mod_perl Red Hat:enterprise_linux:4::ws | All versions | 0:1.99_16-4.5 |
mod_perl-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:1.99_16-4.5 |
mod_perl-devel Red Hat:enterprise_linux:4::ws | All versions | 0:1.99_16-4.5 |
mod_perl Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.0.2-6.3.el5 |
mod_perl-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.0.2-6.3.el5 |
mod_perl-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.0.2-6.3.el5 |
mod_perl Red Hat:enterprise_linux:5::server | All versions | 0:2.0.2-6.3.el5 |
mod_perl-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.0.2-6.3.el5 |
mod_perl-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.0.2-6.3.el5 |
mod_perl Red Hat:network_proxy:5.1::el4 | All versions | 0:2.0.2-12.el4 |
mod_perl-debuginfo Red Hat:network_proxy:5.1::el4 | All versions | 0:2.0.2-12.el4 |
mod_perl Red Hat:rhel_application_stack:1 | All versions | 0:2.0.3-1.el4s1.3 |
mod_perl-debuginfo Red Hat:rhel_application_stack:1 | All versions | 0:2.0.3-1.el4s1.3 |
mod_perl-devel Red Hat:rhel_application_stack:1 | All versions | 0:2.0.3-1.el4s1.3 |
Products include Apache Mod Perl, Canonical Ubuntu Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation and 1 more.
How do I fix CVE-2007-1349?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2007-1349 being exploited?
There is no known exploitation of CVE-2007-1349 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2007-1349, GHSA-fxxc-hq33-c3m6, RHSA-2007:0395, RHSA-2007:0396, RHSA-2007:0486, RHSA-2008:0627.