CVE-2010-2068: Infoleak
modproxyhttp.c in modproxyhttp in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2068?
CVE-2010-2068 is considered a moderate vulnerability that can lead to information disclosure.
How do I fix CVE-2010-2068?
To fix CVE-2010-2068, upgrade to a version of Apache HTTP Server that is not affected, such as versions 2.2.16 or later.
What are the affected versions of Apache HTTP Server in CVE-2010-2068?
The affected versions of Apache HTTP Server are 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha.
Who can exploit CVE-2010-2068?
CVE-2010-2068 can be exploited by remote attackers under certain configurations involving proxy worker pools.
What impact does CVE-2010-2068 have on my system?
CVE-2010-2068 allows remote attackers to potentially obtain sensitive information due to improper timeout detection.