mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE:
this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. (CVE-2010-2791)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0659 advisory.

    - add security fixes for CVE-2010-1452, CVE-2010-2791 (#623210)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated httpd packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

A flaw was discovered in the way the mod_proxy module of the Apache HTTP Server handled the timeouts of requests forwarded by a reverse proxy to the back-end server. If the proxy was configured to reuse existing back-end connections, it could return a response intended for another user under certain timeout conditions, possibly leading to information disclosure. (CVE-2010-2791)

A flaw was found in the way the mod_dav module of the Apache HTTP Server handled certain requests. If a remote attacker were to send a carefully crafted request to the server, it could cause the httpd child process to crash. (CVE-2010-1452)

This update also fixes the following bugs :

* numerous issues in the INFLATE filter provided by mod_deflate.
'Inflate error -5 on flush' errors may have been logged. This update upgrades mod_deflate to the newer upstream version from Apache HTTP Server 2.2.15. (BZ#625435)

* the response would be corrupted if mod_filter applied the DEFLATE filter to a resource requiring a subrequest with an internal redirect.
(BZ#625451)

* the OID() function used in the mod_ssl 'SSLRequire' directive did not correctly evaluate extensions of an unknown type. (BZ#625452)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

A flaw was discovered in the way the mod_proxy module of the Apache HTTP Server handled the timeouts of requests forwarded by a reverse proxy to the back-end server. If the proxy was configured to reuse existing back-end connections, it could return a response intended for another user under certain timeout conditions, possibly leading to information disclosure. (CVE-2010-2791)

A flaw was found in the way the mod_dav module of the Apache HTTP Server handled certain requests. If a remote attacker were to send a carefully crafted request to the server, it could cause the httpd child process to crash. (CVE-2010-1452)

This update also fixes the following bugs :

  - numerous issues in the INFLATE filter provided by     mod_deflate. 'Inflate error -5 on flush' errors may have     been logged. This update upgrades mod_deflate to the     newer upstream version from Apache HTTP Server 2.2.15.
    (BZ#625435)

  - the response would be corrupted if mod_filter applied     the DEFLATE filter to a resource requiring a subrequest     with an internal redirect. (BZ#625451)

  - the OID() function used in the mod_ssl 'SSLRequire'     directive did not correctly evaluate extensions of an     unknown type. (BZ#625452)

After installing the updatedpackages, the httpd daemon must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-25 (Apache HTTP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might obtain sensitive information, gain privileges,       send requests to unintended servers behind proxies, bypass certain       security restrictions, obtain the values of HTTPOnly cookies, or cause a       Denial of Service in various ways.
    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.0.  As such, it is reportedly affected by the following vulnerabilities :

 - An error exists in the 'generate-id' function in the    bundled libxslt library that can allow disclosure of    heap memory addresses. (CVE-2011-0195)

 - An unspecified input validation error exists and can    allow cross-site request forgery attacks. (CVE-2011-3846)

 - Unspecified errors can allow attackers to carry out    denial of service attacks via unspecified vectors.
   (CVE-2012-0135, CVE-2012-1993)

 - The bundled version of PHP contains multiple    vulnerabilities. (CVE-2010-3436, CVE-2010-4409,    CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,    CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,    CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,    CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,    CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)

 - The bundled version of Apache contains multiple    vulnerabilities. (CVE-2010-1452, CVE-2010-1623,    CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,    CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,    CVE-2011-3368, CVE-2011-3639)

 - OpenSSL libraries are contained in several of the    bundled components and contain multiple vulnerabilities.
   (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,    CVE-2011-3207,CVE-2011-3210)

 - Curl libraries are contained in several of the bundled    components and contain multiple vulnerabilities.
   (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0659 advisory.

    The Apache HTTP Server is a popular web server.

    A flaw was discovered in the way the mod_proxy module of the Apache HTTP     Server handled the timeouts of requests forwarded by a reverse proxy to the     back-end server. If the proxy was configured to reuse existing back-end     connections, it could return a response intended for another user under     certain timeout conditions, possibly leading to information disclosure.
    (CVE-2010-2791)

    A flaw was found in the way the mod_dav module of the Apache HTTP Server     handled certain requests. If a remote attacker were to send a carefully     crafted request to the server, it could cause the httpd child process to     crash. (CVE-2010-1452)

    This update also fixes the following bugs:

    * numerous issues in the INFLATE filter provided by mod_deflate. Inflate     error -5 on flush errors may have been logged. This update upgrades     mod_deflate to the newer upstream version from Apache HTTP Server 2.2.15.
    (BZ#625435)

    * the response would be corrupted if mod_filter applied the DEFLATE filter     to a resource requiring a subrequest with an internal redirect. (BZ#625451)

    * the OID() function used in the mod_ssl SSLRequire directive did not     correctly evaluate extensions of an unknown type. (BZ#625452)

    All httpd users should upgrade to these updated packages, which contain     backported patches to correct these issues. After installing the updated     packages, the httpd daemon must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in apache :

The mod_cache and mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path (CVE-2010-1452).

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE:
this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions (CVE-2010-2791).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Versions of Apache HTTP Server earlier than 2.2.10 are potentially affected by multiple vulnerabilities :

  - An information disclosure vulnerability in mod_proxy_http.  Note that this only affects Apache on Unix systems. (CVE-2010-2791)

  - The mod_proxy_ftp module in the version of Apache installed on the remote host fails to properly sanitize user-supplied URL input before using it to generate dynamic HTML output.  Using specially crafted requests for FTP URLs with globbing characters (such as asterisk, tilde, opening square bracket, etc.), an attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. (CVE-2008-2939)

ID	Name	Product	Family	Severity
87660	F5 Networks BIG-IP : Apache HTTPD vulnerability (K23332326)	Nessus	F5 Networks Local Security Checks	medium
68091	Oracle Linux 5 : httpd (ELSA-2010-0659)	Nessus	Oracle Linux Local Security Checks	high
67078	CentOS 5 : httpd (CESA-2010:0659)	Nessus	CentOS Local Security Checks	medium
60847	Scientific Linux Security Update : httpd on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59678	GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
58811	HP System Management Homepage < 7.0 Multiple Vulnerabilities	Nessus	Web Servers	critical
48934	RHEL 5 : httpd (RHSA-2010:0659)	Nessus	Red Hat Local Security Checks	high
48347	Mandriva Linux Security Advisory : apache (MDVSA-2010:153)	Nessus	Mandriva Local Security Checks	medium
4712	Apache < 2.2.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
800555	Apache < 2.2.10 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2010-2791

high

Tenable Plugins

medium

high

medium

medium

high

critical

high

medium

medium

medium