The rotatelogs program on Apache before 1.3.28 for Windows and OS/2 systems does not properly ignore certain control characters that are received over the pipe which could allow remote attackers to cause a denial of service.