CVE-2013-6438 in MacOS X

Summary

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

11/04/2013

Disclosure

03/18/2014

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
74702	Apple MacOS X Apache input validation	20	Not defined	Official fix	CVE-2013-6438
68667	Oracle HTTP Server Web Listener input validation	20	Not defined	Official fix	CVE-2013-6438
67997	Apple Mac OS X input validation	20	Not defined	Official fix	CVE-2013-6438
66689	Apache HTTP Server mod_dav dav_xml_get_cdata input validation	20	Not defined	Official fix	CVE-2013-6438

Sources

• MITRE
• NVD
• CVE Details