PT-2009-6634 · Apache+2 · Apache Http Server+2

Philip Pickett · Published 2009-12-09 · Updated 2024-06-15 · CVE-2010-0434

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x before 2.2.15

Description The issue is related to the ap read request function in the Apache HTTP Server, specifically when a multithreaded MPM is used. It does not properly handle headers in subrequests under certain circumstances, potentially allowing remote attackers to obtain sensitive information via a crafted request. This could trigger access to memory locations associated with an earlier request.

Recommendations For Apache HTTP Server versions 2.2.x before 2.2.15, update to version 2.2.15 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-0434

DSA-2035-1

HPSBUX02531

OPENSUSE-SU-2024:10268-1

RHSA-2010:0168

RHSA-2010:0175

RHSA-2010:0396

RHSA-2010:0602

RHSA-2010_0168

RHSA-2010_0175

Affected Products

Apache Http Server

Hp-Ux

Red Hat

References · 126

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3095 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=918427 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0175.html · Vendor Advisory
• https://issues.apache.org/bugzilla/show_bug.cgi?id=48359 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=127557640302499&w=2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-0434 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• http://httpd.apache.org/security/vulnerabilities_22.html · Vendor Advisory
• http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0740 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939 · Vendor Advisory