CVE-2010-0434: Infoleak
Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15
low: Request header information leak CVE-2010-0434
A bug in the handling of headers in subrequests could lead to a reuse of memory. In a multithreaded MPM this could possibly cause an information leak from other requests being handled by a different thread.
Affects: 2.2.0 - 2.2.14
Upstream bug: https://issues.apache.org/bugzilla/showbug.cgi?id=48359
Upstream commits (2.2.x branch): http://svn.apache.org/viewvc?view=revision&revision=917867 http://svn.apache.org/viewvc?view=revision&revision=918427
Other sources
The apreadrequest function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-0434?
CVE-2010-0434 has a moderate severity rating as it can potentially allow remote attackers to access sensitive data under certain conditions.
How do I fix CVE-2010-0434?
To fix CVE-2010-0434, upgrade Apache HTTP Server to version 2.2.15 or later.
Which versions of Apache HTTP Server are affected by CVE-2010-0434?
Apache HTTP Server versions 2.2.0 through 2.2.14 are affected by CVE-2010-0434.
Are any other software packages affected by CVE-2010-0434?
Yes, CVE-2010-0434 may also affect some Red Hat packages including httpd22, pcsc-lite, and others as listed.
What does CVE-2010-0434 exploit?
CVE-2010-0434 exploits improper handling of headers in subrequests when a multithreaded MPM is used in Apache HTTP Server.