PT-2010-3131 · Apache+2 · Apache Http Server+2

Published 2010-07-25 · Updated 2024-06-15 · CVE-2010-1452

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x through 2.2.15

Description A flaw in the handling of requests by the mod cache and mod dav modules allows remote attackers to cause a denial of service, resulting in a process crash, via a request that lacks a path. This issue is mitigated as mod dav is only affected by requests that are most likely to be authenticated, and mod cache is only affected if the uncommon "CacheIgnoreURLSessionIdentifiers" directive is used.

Recommendations For Apache HTTP Server versions 2.2.x through 2.2.15, update to version 2.2.16 or later to resolve the issue. As a temporary workaround, consider disabling the mod cache and mod dav modules until a patch is available. Restrict access to the affected modules to minimize the risk of exploitation. Avoid using the "CacheIgnoreURLSessionIdentifiers" directive in the mod cache module until the issue is resolved.

Fix

Related Identifiers

CVE-2010-1452

HPSBUX02612

OPENSUSE-SU-2024:10268-1

RHSA-2010:0659

RHSA-2010_0659

RHSA-2011:0897

Affected Products

Apache Http Server

Hp-Ux

Red Hat

References · 116

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1452 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956 · Security Note
• http://marc.info/?l=bugtraq&m=129190899612998&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1452 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1452 · Security Note
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890 · Security Note
• http://marc.info/?l=apache-announce&m=128009718610929&w=2 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0897.html · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.467395 · Vendor Advisory