PT-2010-2183 · Apache+2 · Apache Http Server+2

Niku Toivola · Published 2010-03-02 · Updated 2024-06-15 · CVE-2010-0408

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x through 2.2.14

Description The issue allows remote attackers to cause a denial of service, resulting in a backend server outage. This occurs when a client sends a crafted request with no request body, causing the server to return a wrong status code. A remote attacker could exploit this by sending malicious requests, putting the backend server into an error state until the retry timeout expires.

Recommendations For Apache HTTP Server versions 2.2.x through 2.2.14, update to version 2.2.15 or later to resolve the issue.

Fix

Related Identifiers

CVE-2010-0408

DSA-2035-1

HPSBUX02531

OPENSUSE-SU-2024:10268-1

RHSA-2010:0168

RHSA-2010:0396

RHSA-2010_0168

Affected Products

Apache Http Server

Hp-Ux

Red Hat

References · 110

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0408 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3095 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-0408 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0408 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html · Vendor Advisory
• http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_ajp.c?r1=917876&r2=917875&pathrev=917876 · Patch
• http://marc.info/?l=bugtraq&m=127557640302499&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• http://httpd.apache.org/security/vulnerabilities_22.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:053 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0740 · Security Note