PT-2009-6634 · Apache+2 · Apache Http Server+2

Philip Pickett · Publicado 2009-12-09 · Atualizado 2024-06-15 · CVE-2010-0434

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x before 2.2.15

Description The issue is related to the ap read request function in the Apache HTTP Server, specifically when a multithreaded MPM is used. It does not properly handle headers in subrequests under certain circumstances, potentially allowing remote attackers to obtain sensitive information via a crafted request. This could trigger access to memory locations associated with an earlier request.

Recommendations For Apache HTTP Server versions 2.2.x before 2.2.15, update to version 2.2.15 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-0434

DSA-2035-1

HPSBUX02531

OPENSUSE-SU-2024:10268-1

RHSA-2010:0168

RHSA-2010:0175

RHSA-2010:0396

RHSA-2010:0602

RHSA-2010_0168

RHSA-2010_0175

Produtos afetados

Apache Http Server

Hp-Ux

Red Hat

Referências · 126

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094 · Nota de Segurança
• http://secunia.com/advisories/39628 · Nota
• https://suse.com/security/cve/CVE-2009-3095 · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://suse.com/security/cve/CVE-2014-0118 · Nota
• https://access.redhat.com/errata/RHSA-2010:0175 · Nota
• https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E · Nota
• http://support.apple.com/kb/HT4435 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3095 · Nota de Segurança
• http://vupen.com/english/advisories/2010/1057 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E · Nota