National Cyber Awareness System

Vulnerability Summary for CVE-2010-2791

Overview

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: apache-modproxy-info-disclsoure(60883)

Hyperlink:http://xforce.iss.net/xforce/xfdb/60883

External Source: BID

Name: 42102

Hyperlink:http://www.securityfocus.com/bid/42102

External Source: REDHAT

Name: RHSA-2010:0659

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0659.html

External Source: CONFIRM

Name: http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

Hyperlink:http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

External Source: MLIST

Name: [oss-security] 20100730 CVE-2010-2791: mod_proxy information leak affecting 2.2.9 only

Hyperlink:http://www.openwall.com/lists/oss-security/2010/07/30/1