PT-2009-3741 · Apache · Apache Http Server

Sander De Boer · Publicado 2009-04-21 · Atualizado 2024-06-15 · CVE-2009-1191

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.2.11

Description The issue allows remote attackers to obtain sensitive response data intended for a client that sent an earlier POST request with no request body, via an HTTP request. This can occur in certain situations when a user sends a carefully crafted HTTP request.

Recommendations For Apache HTTP Server version 2.2.11, consider disabling the mod proxy ajp module until a patch is available to prevent exploitation. Restrict access to sensitive data to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2009-1191

OPENSUSE-SU-2024:10268-1

RHSA-2009:1058

Produtos afetados

Apache Http Server

Referências · 88

• https://suse.com/security/cve/CVE-2009-3095 · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://suse.com/security/cve/CVE-2014-0118 · Nota
• http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2009:102 · Aviso do Fabricante
• http://support.apple.com/kb/HT3937 · Nota
• https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E · Nota
• http://vupen.com/english/advisories/2009/3184 · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8261 · Nota
• https://suse.com/security/cve/CVE-2011-3368 · Nota
• https://osv.dev/vulnerability/CVE-2009-1191 · Aviso do Fabricante
• https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2015-0253 · Nota
• https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E · Nota