CVE-2010-0408: Medium severity Apache HTTP Server vulnerability
Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15
moderate: modproxyajp DoS CVE-2010-0408
modproxyajp would return the wrong status code if it encountered an error causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a denial of service.
Affects: 2.2.0 - 2.2.14
Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=917876
Other sources
The approxyajprequest function in modproxyajp.c in modproxyajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-0408?
The severity of CVE-2010-0408 is classified as moderate.
How do I fix CVE-2010-0408?
To fix CVE-2010-0408, upgrade to a patched version such as httpd 2.2.14 or later.
What are the affected versions in CVE-2010-0408?
CVE-2010-0408 affects Apache HTTP Server versions up to 2.2.14.
Can CVE-2010-0408 lead to a denial of service?
Yes, CVE-2010-0408 can be exploited to cause a denial of service (DoS) condition.
Which packages are vulnerable to CVE-2010-0408?
Vulnerable packages to CVE-2010-0408 include httpd22 and httpd in versions earlier than 2.2.14.