Vulnerability Description
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.0.35, < 2.0.64 |
| Fedoraproject | Fedora | 11 |
| Debian | Debian Linux | 5.0 |
Related Weaknesses (CWE)
References
- http://httpd.apache.org/security/vulnerabilities_22.htmlPatchVendor Advisory
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlBroken LinkMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.htmlMailing ListThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlMailing ListThird Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000105.htmlMailing ListThird Party Advisory
- http://marc.info/?l=bugtraq&m=127557640302499&w=2Issue TrackingMailing ListThird Party Advisory
- http://secunia.com/advisories/39100Not Applicable
- http://secunia.com/advisories/39115Not Applicable
- http://secunia.com/advisories/39501Not Applicable
- http://secunia.com/advisories/39628Not Applicable
- http://secunia.com/advisories/39632Not Applicable
- http://secunia.com/advisories/39656Not Applicable
- http://secunia.com/advisories/40096Not Applicable
- http://support.apple.com/kb/HT4435Broken Link
FAQ
What is CVE-2010-0434?
CVE-2010-0434 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstan...
How severe is CVE-2010-0434?
CVE-2010-0434 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-0434?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Debian Debian Linux.