CVE-2013-1896 Denial of service in n/a

Medium 4.3 Published 10 Jul 2013 Updated 6 Aug 2024

Remote attackers can cause a denial of service via a crafted MERGE request when mod_dav_svn is configured, affecting Apache HTTP Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-1896?

CVE-2013-1896 is a medium-severity denial of service vulnerability in Apache Http Server, published on 10 Jul 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Which versions are affected by CVE-2013-1896?

It affects 9 products.

Linux distribution packages (29)

`httpd` Red Hat:enterprise_linux:5::server	All versions	`0:2.2.3-82.el5_9`
`httpd-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.2.3-82.el5_9`
`httpd-devel` Red Hat:enterprise_linux:5::server	All versions	`0:2.2.3-82.el5_9`
`httpd-manual` Red Hat:enterprise_linux:5::server	All versions	`0:2.2.3-82.el5_9`
`mod_ssl` Red Hat:enterprise_linux:5::server	All versions	`1:2.2.3-82.el5_9`
`httpd` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-29.el6_4`
`httpd-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-29.el6_4`
`httpd-devel` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-29.el6_4`
`httpd-manual` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-29.el6_4`
`httpd-tools` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-29.el6_4`
`mod_ssl` Red Hat:enterprise_linux:6::client	All versions	`1:2.2.15-29.el6_4`
`httpd` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-29.el6_4`
`httpd-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-29.el6_4`
`httpd-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-29.el6_4`
`httpd-manual` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-29.el6_4`
`httpd-tools` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-29.el6_4`
`mod_ssl` Red Hat:enterprise_linux:6::computenode	All versions	`1:2.2.15-29.el6_4`
`httpd` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-29.el6_4`
`httpd-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-29.el6_4`
`httpd-devel` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-29.el6_4`
`httpd-manual` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-29.el6_4`
`httpd-tools` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-29.el6_4`
`mod_ssl` Red Hat:enterprise_linux:6::server	All versions	`1:2.2.15-29.el6_4`
`httpd` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-29.el6_4`
`httpd-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-29.el6_4`
`httpd-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-29.el6_4`
`httpd-manual` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-29.el6_4`
`httpd-tools` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-29.el6_4`
`mod_ssl` Red Hat:enterprise_linux:6::workstation	All versions	`1:2.2.15-29.el6_4`

Products include Apache Http Server, Canonical Ubuntu Linux, Opensuse Opensuse, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server and 3 more.

How do I fix CVE-2013-1896?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-1896 being exploited?

There is no known exploitation of CVE-2013-1896 in the wild and no public exploit code.

All Apache Http Server vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-1896, GHSA-g852-xcg2-2w9v, MGASA-2013-0230, RHSA-2013:1156.