CVE-2011-1928 in HTTP Server
Summary
by MITRE
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/19/2021
The vulnerability described in CVE-2011-1928 represents a critical denial of service flaw within the Apache Portable Runtime library that affects multiple Apache HTTP Server versions. This issue manifests as an infinite loop condition in the fnmatch implementation, specifically within the apr_fnmatch.c file, which is a core component of the APR library used extensively throughout Apache software ecosystems. The vulnerability was introduced as an incorrect fix for a previous vulnerability CVE-2011-0419, demonstrating how remediation efforts can sometimes create new security weaknesses when not thoroughly tested against all possible input scenarios. The flaw particularly impacts the mod_autoindex module in Apache HTTP Server 2.2.18, where specific URI patterns can trigger the problematic behavior, making it a significant concern for web server administrators and security practitioners.
The technical implementation of this vulnerability stems from the fnmatch function's inadequate handling of certain wildcard pattern combinations, specifically those involving multiple consecutive wildcards or complex nested patterns. When processing URIs that match patterns such as /*/WEB-INF/, the fnmatch implementation enters an infinite loop due to flawed backtracking logic in its pattern matching algorithm. This occurs because the function fails to properly terminate its matching process when encountering certain combinations of wildcard characters, leading to continuous iteration through the pattern matching state machine. The vulnerability operates at the core level of the APR library, making it particularly dangerous as it can affect any application or module that relies on the library's pattern matching capabilities, including but not limited to Apache HTTP Server modules, mod_rewrite, and mod_autoindex functionality. The issue demonstrates characteristics consistent with CWE-835, which specifically addresses infinite loops in pattern matching implementations.
The operational impact of this vulnerability extends beyond simple service disruption, as it can be exploited by remote attackers to consume excessive system resources and potentially cause complete service unavailability. Attackers can craft malicious URIs that trigger the infinite loop condition, causing the Apache HTTP Server process to consume 100% CPU resources and become unresponsive to legitimate requests. This makes the vulnerability particularly dangerous in production environments where server availability is critical, as it can be exploited to perform resource exhaustion attacks without requiring authentication or specific privileges. The attack vector is particularly concerning because it can be executed against publicly accessible web servers, making it a viable method for denial of service attacks that can significantly impact web services and potentially affect business operations. The vulnerability's presence in both APR library versions 1.4.3 and 1.4.4, as well as Apache HTTP Server 2.2.18, indicates a widespread exposure that affects numerous deployments across different organizations and environments.
Mitigation strategies for CVE-2011-1928 should focus on immediate patching of affected systems to address the root cause of the infinite loop condition in the APR library's fnmatch implementation. Organizations should prioritize updating to patched versions of both the APR library and Apache HTTP Server, ensuring that all components are upgraded to versions that contain proper fixes for the pattern matching logic. Additionally, administrators should implement input validation and sanitization measures at the web server level to prevent malicious URI patterns from reaching the vulnerable fnmatch functions, though this approach is considered less robust than proper patching. Network-level protections such as rate limiting and URI filtering can provide temporary mitigation while patches are deployed, but these measures do not address the underlying implementation flaw. The vulnerability serves as a reminder of the importance of thorough regression testing when implementing security fixes, as the incorrect approach to CVE-2011-0419 inadvertently created this new vulnerability, highlighting the need for comprehensive testing across all possible attack scenarios before deploying security patches to production environments.