tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - apr: hash table collisions CPU usage DoS (CVE-2012-0840)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - apr: Out-of-bounds array deref in apr_time_exp*() functions (CVE-2017-12613)

  - tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without     restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers     to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash     table. (CVE-2012-0840)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - apr: hash table collisions CPU usage DoS (CVE-2012-0840)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201405-24 (Apache Portable Runtime, APR Utility Library: Denial of Service)

    Multiple vulnerabilities have been discovered in Apache Portable Runtime       and APR Utility Library. Please review the CVE identifiers referenced       below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

CVE-2012-0840 apr: hash table collisions CPU usage DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in ASF APR :

tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table (CVE-2012-0840).

APR has been upgraded to the latest version (1.4.6) which holds many improvments over the previous versions and is not vulnerable to this issue.

ID	Name	Product	Family	Severity
198525	RHEL 4 : apr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198496	RHEL 5 : apr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198473	RHEL 6 : apr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
74066	GLSA-201405-24 : Apache Portable Runtime, APR Utility Library: Denial of Service	Nessus	Gentoo Local Security Checks	medium
58188	Fedora 16 : apr-1.4.6-1.fc16 (2012-1709)	Nessus	Fedora Local Security Checks	medium
58187	Fedora 15 : apr-1.4.6-1.fc15 (2012-1656)	Nessus	Fedora Local Security Checks	medium
57955	Mandriva Linux Security Advisory : apr (MDVSA-2012:019)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2012-0840

high

Tenable Plugins

high

high

high

medium

medium

medium

medium