CVE-2012-0021

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.17 through 2.2.21

Description The issue is related to the mod log config module, specifically the log cookie function in mod log config.c. When a threaded MPM is used, it does not properly handle a %{cookiename}C format string. This allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value, or by sending a specific cookie.

Recommendations For Apache HTTP Server versions 2.2.17 through 2.2.21, consider disabling the mod log config module or avoiding the use of the '%{cookiename}C' log format string until a patch is available. Restrict access to the server to minimize the risk of exploitation.