PT-2010-2867 · Apache · Apache Http Server

Published 2010-04-20 · Updated 2010-05-27 · CVE-2010-1151

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server (affected versions not specified)

Description A race condition in the mod auth shadow module allows remote attackers to bypass authentication and potentially read or modify data. This issue arises from improper interaction with an external helper application used for validating credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2010-1151

Affected Products

Apache Http Server

References · 9

• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041340.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1151 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2010:081 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041326.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=578168 · Patch
• http://securityfocus.com/bid/39538 · Note
• http://secunia.com/advisories/39823 · Note
• http://vupen.com/english/advisories/2010/1148 · Note
• http://vupen.com/english/advisories/2010/0908 · Note