National Vulnerability Database (NVD) National Vulnerability Database (CVE-2010-0434)

National Cyber Awareness System

Vulnerability Summary for CVE-2010-0434

Original release date:03/05/2010

Last revised:11/18/2010

Source: US-CERT/NIST

Overview

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:N/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Allows unauthorized disclosure of information

Vendor Statements (disclaimer)

Official Statement from Red Hat (04/13/2010)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0434 This issue was fixed in Red Hat Enterprise Linux 5 via: https://rhn.redhat.com/errata/RHSA-2010-0168.html This issue was fixed in Red Hat Enterprise Linux 4 via: https://rhn.redhat.com/errata/RHSA-2010-0175.html The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw on Red Hat Enterprise Linux 3. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://httpd.apache.org/security/vulnerabilities_22.html

Type: Advisory; Patch Information

Hyperlink:http://httpd.apache.org/security/vulnerabilities_22.html

External Source: CONFIRM

Name: https://issues.apache.org/bugzilla/show_bug.cgi?id=48359

Hyperlink:https://issues.apache.org/bugzilla/show_bug.cgi?id=48359

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=570171

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=570171

External Source: XF

Name: apache-http-rh-info-disclosure(56625)

Hyperlink:http://xforce.iss.net/xforce/xfdb/56625

External Source: VUPEN

Name: ADV-2010-1411

Hyperlink:http://www.vupen.com/english/advisories/2010/1411

External Source: VUPEN

Name: ADV-2010-1057

Hyperlink:http://www.vupen.com/english/advisories/2010/1057

External Source: VUPEN

Name: ADV-2010-1001

Hyperlink:http://www.vupen.com/english/advisories/2010/1001

External Source: VUPEN

Name: ADV-2010-0994

Hyperlink:http://www.vupen.com/english/advisories/2010/0994

External Source: VUPEN

Name: ADV-2010-0911

Hyperlink:http://www.vupen.com/english/advisories/2010/0911

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2010-0014.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2010-0014.html

External Source: BID

Name: 38494

Hyperlink:http://www.securityfocus.com/bid/38494

External Source: REDHAT

Name: RHSA-2010:0175

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0175.html

External Source: REDHAT

Name: RHSA-2010:0168

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0168.html

External Source: DEBIAN

Name: DSA-2035

Hyperlink:http://www.debian.org/security/2010/dsa-2035

External Source: AIXAPAR

Name: PM15829

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829

External Source: AIXAPAR

Name: PM12247

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

External Source: AIXAPAR

Name: PM08939

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=918427

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=918427

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=917867

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=917867

External Source: CONFIRM

Name: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h

Hyperlink:http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4435

Hyperlink:http://support.apple.com/kb/HT4435

External Source: SECUNIA

Name: 40096

Hyperlink:http://secunia.com/advisories/40096

External Source: SECUNIA

Name: 39656

Hyperlink:http://secunia.com/advisories/39656

External Source: SECUNIA

Name: 39632

Hyperlink:http://secunia.com/advisories/39632

External Source: SECUNIA

Name: 39628

Hyperlink:http://secunia.com/advisories/39628

External Source: SECUNIA

Name: 39501

Hyperlink:http://secunia.com/advisories/39501

External Source: SECUNIA

Name: 39115

Hyperlink:http://secunia.com/advisories/39115

External Source: SECUNIA

Name: 39100

Hyperlink:http://secunia.com/advisories/39100

External Source: OVAL

Name: oval:org.mitre.oval:def:8695

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8695

External Source: OVAL

Name: oval:org.mitre.oval:def:10358

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10358

External Source: MLIST

Name: [security-announce] 20100923 VMSA-2010-0014 VMware Workstation, Player, and ACE address several security issues

Hyperlink:http://lists.vmware.com/pipermail/security-announce/2010/000105.html

External Source: SUSE

Name: SUSE-SR:2010:010

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

External Source: FEDORA

Name: FEDORA-2010-6131

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html

External Source: FEDORA

Name: FEDORA-2010-5942

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html

External Source: APPLE

Name: APPLE-SA-2010-11-10-1

Hyperlink:http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

References to Check Content

Identifier:oval:org.mitre.oval:def:10358

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10358

Identifier:oval:org.mitre.oval:def:8695

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:8695

Vulnerable software and versions

Configuration 1

* cpe:/a:apache:http_server:2.2

* cpe:/a:apache:http_server:2.2.0

* cpe:/a:apache:http_server:2.2.1

* cpe:/a:apache:http_server:2.2.2

* cpe:/a:apache:http_server:2.2.3

* cpe:/a:apache:http_server:2.2.4

* cpe:/a:apache:http_server:2.2.5

* cpe:/a:apache:http_server:2.2.6

* cpe:/a:apache:http_server:2.2.8

* cpe:/a:apache:http_server:2.2.9

* cpe:/a:apache:http_server:2.2.11

* cpe:/a:apache:http_server:2.2.12

* cpe:/a:apache:http_server:2.2.13

* cpe:/a:apache:http_server:2.2.14

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Information Leak / Disclosure (CWE-200)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0434