PT-2009-3741 · Apache · Apache Http Server

Sander De Boer · Published 2009-04-21 · Updated 2024-06-15 · CVE-2009-1191

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.2.11

Description The issue allows remote attackers to obtain sensitive response data intended for a client that sent an earlier POST request with no request body, via an HTTP request. This can occur in certain situations when a user sends a carefully crafted HTTP request.

Recommendations For Apache HTTP Server version 2.2.11, consider disabling the mod proxy ajp module until a patch is available to prevent exploitation. Restrict access to sensitive data to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2009-1191

OPENSUSE-SU-2024:10268-1

RHSA-2009:1058

Affected Products

Apache Http Server

References · 88

• http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:102 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1191 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1191 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html · Vendor Advisory
• https://issues.apache.org/bugzilla/show_bug.cgi?id=46949 · Vendor Advisory
• http://apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1191 · Security Note
• http://security.gentoo.org/glsa/glsa-200907-04.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-787-1 · Vendor Advisory
• http://securityfocus.com/bid/34663 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1191 · Vendor Advisory
• https://suse.com/security/cve/CVE-2009-3095 · Note