CVE-2010-0434

Published: Mar 5, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Affected (6)

Products: Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.0.35 to 2.0.64
Apache Http Server	From 2.2.0 to 2.2.15

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 11
Fedoraproject Fedora	Version 13

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (118)

http://httpd.apache.org/security/vulnerabilities_22.html

Source: secalert@redhat.com

PatchVendor Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: secalert@redhat.com

Broken LinkMailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.vmware.com/pipermail/security-announce/2010/000105.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=127557640302499&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://secunia.com/advisories/39100

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/39115

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/39501

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/39628

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/39632

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/39656

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/40096

Source: secalert@redhat.com

Not Applicable

http://support.apple.com/kb/HT4435

Source: secalert@redhat.com

Broken Link

http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h

Source: secalert@redhat.com

PatchVendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=917867

Source: secalert@redhat.com

PatchVendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=918427

Source: secalert@redhat.com

PatchVendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2010/dsa-2035

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0168.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0175.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/38494

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2010-0014.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0911

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/0994

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/1001

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/1057

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/1411

Source: secalert@redhat.com

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=570171

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/56625

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://issues.apache.org/bugzilla/show_bug.cgi?id=48359

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695

Source: secalert@redhat.com

Third Party Advisory

http://httpd.apache.org/security/vulnerabilities_22.html