CVE-2011-3192 - 漏洞详情

CVE-2011-3192 (CNNVD-201108-440)

HIGH 有利用代码

中文标题:

Apache HTTP Server拒绝服务漏洞

英文标题:

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19...

CVSS分数: 7.8

发布时间: 2011-08-29 15:00:00

漏洞类型: 资源管理错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v5

漏洞描述

中文描述:

Apache HTTP Server是一款开源的流行的HTTPD服务程序。当处理包含大量Ranges头的HTTP请求时，ByteRange过滤器存在一个错误，攻击者可以向服务器发送特制HTTP请求，消耗大量内存，造成应用程序崩溃。

英文描述:

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

CWE类型:

CWE-400

受影响产品

厂商	产品	版本	版本范围	平台	CPE
apache	http_server	*	-	-	`cpe:2.3:a:apache:http_server::::::::`
opensuse	opensuse	11.3	-	-	`cpe:2.3:o:opensuse:opensuse:11.3:::::::*`
opensuse	opensuse	11.4	-	-	`cpe:2.3:o:opensuse:opensuse:11.4:::::::*`
suse	linux_enterprise_server	10	-	-	`cpe:2.3:o:suse:linux_enterprise_server:10:sp2:::-:::*`
suse	linux_enterprise_server	11	-	-	`cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::-::*`
suse	linux_enterprise_software_development_kit	10	-	-	`cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3::::::`
suse	linux_enterprise_software_development_kit	11	-	-	`cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1::::::`
canonical	ubuntu_linux	8.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::`
canonical	ubuntu_linux	10.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::`
canonical	ubuntu_linux	10.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*`
canonical	ubuntu_linux	11.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

45606 third-party-advisory
cve.org

访问

RHSA-2011:1369 vendor-advisory
cve.org

访问

RHSA-2011:1329 vendor-advisory
cve.org

访问

HPSBUX02707 vendor-advisory
cve.org

访问

SUSE-SU-2011:1010 vendor-advisory
cve.org

访问

SSRT100966 vendor-advisory
cve.org

访问

openSUSE-SU-2011:0993 vendor-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

1025960 vdb-entry
cve.org

访问

[dev] 20110823 Re: DoS with mod_deflate & range requests mailing-list
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

SSRT100624 vendor-advisory
cve.org

访问

17696 exploit
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

HPSBUX02702 vendor-advisory
cve.org

访问

46000 third-party-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

SSRT100619 vendor-advisory
cve.org

访问

20110830 Apache HTTPd Range Header Denial of Service Vulnerability vendor-advisory
cve.org

访问

USN-1199-1 vendor-advisory
cve.org

访问

MDVSA-2011:130 vendor-advisory
cve.org

访问

49303 vdb-entry
cve.org

访问

74721 vdb-entry
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

20110824 Re: Apache Killer mailing-list
cve.org

访问

APPLE-SA-2011-10-12-3 vendor-advisory
cve.org

访问

oval:org.mitre.oval:def:14824 vdb-entry
cve.org

访问

[announce] 20110824 Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\) mailing-list
cve.org

访问

RHSA-2011:1330 vendor-advisory
cve.org

访问

apache-http-byterange-dos(69396) vdb-entry
cve.org

访问

46126 third-party-advisory
cve.org

访问

RHSA-2011:1245 vendor-advisory
cve.org

访问

oval:org.mitre.oval:def:18827 vdb-entry
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

46125 third-party-advisory
cve.org

访问

VU#405811 third-party-advisory
cve.org

访问

20110820 Apache Killer mailing-list
cve.org

访问

SSRT100852 vendor-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

SUSE-SU-2011:1216 vendor-advisory
cve.org

访问

oval:org.mitre.oval:def:14762 vdb-entry
cve.org

访问

SUSE-SU-2011:1007 vendor-advisory
cve.org

访问

SUSE-SU-2011:1000 vendor-advisory
cve.org

访问

RHSA-2011:1294 vendor-advisory
cve.org

访问

MDVSA-2013:150 vendor-advisory
cve.org

访问

SUSE-SU-2011:1229 vendor-advisory
cve.org

访问

RHSA-2011:1300 vendor-advisory
cve.org

访问

45937 third-party-advisory
cve.org

访问

[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/ mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073149 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
cve.org

访问

[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

ExploitDB EDB-17696 EXPLOIT
exploitdb

访问

Download Exploit EDB-17696 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2014-5329 ADVISORY
cve.org

访问

CVE Reference: CVE-2011-3192 ADVISORY
cve.org

访问

ExploitDB EDB-18221 EXPLOIT
exploitdb

访问

Download Exploit EDB-18221 EXPLOIT
exploitdb

访问

CVSS评分详情

7.8

HIGH

CVSS向量: AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS版本: 2.0

机密性

NONE

完整性

NONE

可用性

COMPLETE

时间信息

发布时间:

2011-08-29 15:00:00

修改时间:

2024-08-06 23:29:55

创建时间:

2025-11-11 15:33:17

更新时间:

2025-11-11 16:13:40

利用信息

此漏洞有可利用代码！

利用代码数量: 2

利用来源:

未知未知

数据源详情

数据源	记录ID	版本	提取时间
CVE	`cve_CVE-2011-3192`	2025-11-11 15:18:23	2025-11-11 07:33:17
NVD	`nvd_CVE-2011-3192`	2025-11-11 14:53:43	2025-11-11 07:42:06
CNNVD	`cnnvd_CNNVD-201108-440`	2025-11-11 15:09:13	2025-11-11 07:49:53
EXPLOITDB	`exploitdb_EDB-17696`	2025-11-11 15:05:27	2025-11-11 08:12:52
EXPLOITDB	`exploitdb_EDB-18221`	2025-11-11 15:05:24	2025-11-11 08:13:40

版本与语言

当前版本: v5

主要语言: EN

支持语言:

EN ZH

其他标识符:

安全公告

暂无安全公告信息

变更历史

v5 EXPLOITDB

2025-11-11 16:13:40

references_count: 76 → 78; tags_count: 4 → 6

查看详细变更

references_count: 76 -> 78
tags_count: 4 -> 6

v4 EXPLOITDB

2025-11-11 16:12:52

references_count: 72 → 76; tags_count: 0 → 4; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']

查看详细变更

references_count: 72 -> 76
tags_count: 0 -> 4
data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']

v3 CNNVD

2025-11-11 15:49:53

vulnerability_type: 未提取 → 资源管理错误; cnnvd_id: 未提取 → CNNVD-201108-440; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']

查看详细变更

vulnerability_type: 未提取 -> 资源管理错误
cnnvd_id: 未提取 -> CNNVD-201108-440
data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']

v2 NVD

2025-11-11 15:42:06

severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.8; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:N/I:N/A:C; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 11; references_count: 78 → 72; data_sources: ['cve'] → ['cve', 'nvd']

查看详细变更

severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
cvss_score: 未提取 -> 7.8
cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:N/I:N/A:C
cvss_version: NOT_EXTRACTED -> 2.0
affected_products_count: 0 -> 11
references_count: 78 -> 72
data_sources: ['cve'] -> ['cve', 'nvd']

CVE-2011-3192 (CNNVD-201108-440)

中文标题:

Apache HTTP Server拒绝服务漏洞

英文标题:

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19...

漏洞描述

中文描述:

英文描述:

CWE类型:

标签:

受影响产品

解决方案

中文解决方案:

英文解决方案:

临时解决方案:

参考链接

CVSS评分详情

时间信息

利用信息

数据源详情

版本与语言

安全公告

变更历史