CVE-2010-0434
published 2010-03-05CVE-2010-0434: The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle…
PriorityP432medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
18.44%
96.9th percentile
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.0.35 < 2.0.64 | 2.0.64 |
| apache | http_server | >= 2.2.0 < 2.2.15 | 2.2.15 |
| apache | httpd | — | — |
| debian | apache2 | < apache2 2.2.15-1 (bookworm) | apache2 2.2.15-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv4.3MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_apache4.3LOW
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Workstation, Player, and ACE address several security issues.
vendor_vmware·2010-09-23·CVSS 2.1
CVE-2010-0205 [LOW] VMware Workstation, Player, and ACE address several security issues.
VMSA-2010-0014: VMware Workstation, Player, and ACE address several security issues.
a. VMware Workstation and Player installer security issue The Workstation 7.x and Player 3.x installers will load an index.htm file located in the current working directory on which Workstation 7.x or Player 3.x is being installed. This may allow an attacker to display a malicious file if they manage to get their file onto the system prior to installation. The issue can only be exploited at the time that Workstation 7.x or Player 3.x is being installed. Installed versions of Workstation and Player are not affected. The security issue is no longer present in the installer of the new versions of Workstation 7.x and Player 3.x (see table below for the version numbers). The Common Vulnerabilities and Exposure
Ubuntu
Apache vulnerabilities
vendor_ubuntu·2010-03-10·CVSS 5.0
CVE-2010-0408 [MEDIUM] Apache vulnerabilities
Title: Apache vulnerabilities
Summary: Apache vulnerabilities
It was discovered that mod_proxy_ajp did not properly handle errors when
a client doesn't send a request body. A remote attacker could exploit this
with a crafted request and cause a denial of service. This issue affected
Ubuntu 8.04 LTS, 8.10, 9.04 and 9.10. (CVE-2010-0408)
It was discovered that Apache did not properly handle headers in
subrequests under certain conditions. A remote attacker could exploit this
with a crafted request and possibly obtain sensitive information from
previous requests. (CVE-2010-0434)
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Debian
CVE-2010-0434: apache2 - The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2....
vendor_debian·2010·CVSS 4.3
CVE-2010-0434 [MEDIUM] CVE-2010-0434: apache2 - The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2....
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
Scope: local
bookworm: resolved (fixed in 2.2.15-1)
bullseye: resolved (fixed in 2.2.15-1)
forky: resolved (fixed in 2.2.15-1)
sid: resolved (fixed in 2.2.15-1)
trixie: resolved (fixed in 2.2.15-1)
Red Hat
httpd: request header information leak
vendor_redhat·2009-12-09·CVSS 4.3
CVE-2010-0434 [MEDIUM] httpd: request header information leak
httpd: request header information leak
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
Apache
Apache httpd: CVE-2010-0434
vendor_apache·CVSS 4.3
CVE-2010-0434 [LOW] Apache httpd: CVE-2010-0434
Apache httpd: CVE-2010-0434
A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array to the subrequest, instead of a pointer to the parent request's array as it had for requests without request bodies. This meant all modules such as mod_headers which may manipulate the input headers for a subrequest would poison the parent request in two ways, one by modifying the parent request, which might not be intended, and second by leaving pointers to modified header fields in memory allocated to the subrequest scope, which could be freed before the main request processing was finished, resulting in a segfault or in revealing data from another request on threaded servers, such as the worker or winnt MPMs. Acknowledgements: We would like to thank
GHSA
GHSA-jm28-fmm3-4cr6: The ap_read_request function in server/protocol
ghsa_unreviewed·2022-05-02
CVE-2010-0434 [MEDIUM] CWE-200 GHSA-jm28-fmm3-4cr6: The ap_read_request function in server/protocol
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
OSV
CVE-2010-0434: The ap_read_request function in server/protocol
osv·2010-03-05·CVSS 4.3
CVE-2010-0434 [MEDIUM] CVE-2010-0434: The ap_read_request function in server/protocol
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
No detection rules found.
No public exploits indexed.
http://httpd.apache.org/security/vulnerabilities_22.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://marc.info/?l=bugtraq&m=127557640302499&w=2http://secunia.com/advisories/39100http://secunia.com/advisories/39115http://secunia.com/advisories/39501http://secunia.com/advisories/39628http://secunia.com/advisories/39632http://secunia.com/advisories/39656http://secunia.com/advisories/40096http://support.apple.com/kb/HT4435http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=hhttp://svn.apache.org/viewvc?view=revision&revision=917867http://svn.apache.org/viewvc?view=revision&revision=918427http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829http://www.debian.org/security/2010/dsa-2035http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0168.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0175.htmlhttp://www.securityfocus.com/bid/38494http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlhttp://www.vupen.com/english/advisories/2010/0911http://www.vupen.com/english/advisories/2010/0994http://www.vupen.com/english/advisories/2010/1001http://www.vupen.com/english/advisories/2010/1057http://www.vupen.com/english/advisories/2010/1411https://bugzilla.redhat.com/show_bug.cgi?id=570171https://exchange.xforce.ibmcloud.com/vulnerabilities/56625https://issues.apache.org/bugzilla/show_bug.cgi?id=48359https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695http://httpd.apache.org/security/vulnerabilities_22.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://marc.info/?l=bugtraq&m=127557640302499&w=2http://secunia.com/advisories/39100http://secunia.com/advisories/39115http://secunia.com/advisories/39501http://secunia.com/advisories/39628http://secunia.com/advisories/39632http://secunia.com/advisories/39656http://secunia.com/advisories/40096http://support.apple.com/kb/HT4435http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=hhttp://svn.apache.org/viewvc?view=revision&revision=917867http://svn.apache.org/viewvc?view=revision&revision=918427http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829http://www.debian.org/security/2010/dsa-2035http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0168.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0175.htmlhttp://www.securityfocus.com/bid/38494http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlhttp://www.vupen.com/english/advisories/2010/0911http://www.vupen.com/english/advisories/2010/0994http://www.vupen.com/english/advisories/2010/1001http://www.vupen.com/english/advisories/2010/1057http://www.vupen.com/english/advisories/2010/1411https://bugzilla.redhat.com/show_bug.cgi?id=570171https://exchange.xforce.ibmcloud.com/vulnerabilities/56625https://issues.apache.org/bugzilla/show_bug.cgi?id=48359https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E
+ 18 more references
2010-03-05
Published