PT-2012-2266 · Apache+4 · Apache Http Server+4

Published 2012-01-23 · Updated 2024-06-15 · CVE-2012-0053

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x through 2.2.21

Description The issue allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a long or malformed header in conjunction with crafted web script, specifically when the server constructs Bad Request (400) error documents without proper restriction of header information. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified.

Recommendations For Apache HTTP Server versions 2.2.x through 2.2.21, consider specifying a custom ErrorDocument for status code 400 to prevent exposure of "httpOnly" cookies. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CESA-2012_0128

CVE-2012-0053

DSA-2405-1

HPSBUX02761

OPENSUSE-SU-2024:10268-1

RHSA-2012:0128

RHSA-2012:0323

RHSA-2012:0542

RHSA-2012_0128

RHSA-2012_0323

Affected Products

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

References · 149

• 🔥 https://exploit-db.com/exploits/18442 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3639 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0543.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0031 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0053 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0542.html · Vendor Advisory
• http://httpd.apache.org/security/vulnerabilities_22.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133951357207000&w=2 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0053 · Security Note
• http://marc.info/?l=bugtraq&m=133494237717847&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3607 · Security Note
• http://debian.org/security/2012/dsa-2405 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0053 · Vendor Advisory