PT-2007-3209 · Apache · Apache+1

Published 2007-06-01 · Updated 2024-06-15 · CVE-2007-1862

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache version 2.2.4

Description: The issue arises from the recall headers function in mod mem cache, which fails to properly copy all levels of header data. This can cause Apache to return HTTP headers containing previously used data, potentially allowing remote attackers to obtain sensitive information.

Recommendations: For Apache version 2.2.4, consider disabling the mod mem cache module until a patch is available to prevent the recall headers function from being exploited. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1862

OPENSUSE-SU-2024:10623-1

Affected Products

Apache

Apache Http Server

References · 61

• http://security.gentoo.org/glsa/glsa-200711-06.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1862 · Security Note
• http://redhat.com/archives/fedora-package-announce/2007-September/msg00320.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:127 · Vendor Advisory
• https://suse.com/security/cve/CVE-2008-2939 · Note
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E · Note
• https://suse.com/security/cve/CVE-2007-3304 · Note
• https://suse.com/security/cve/CVE-2007-6421 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://suse.com/security/cve/CVE-2008-2364 · Note
• https://suse.com/security/cve/CVE-2007-5000 · Note
• https://suse.com/security/cve/CVE-2008-1678 · Note