CVE-2012-0053: Medium severity Apache HTTP Server vulnerability
A flaw was found in the default error response for status code 400. This could be used by an attacker to expose "httpOnly" cookies, when no custom ErrorDocument was specified.
This affects all versions of Apache from 2.2.0 up to and including 2.2.21. It will be fixed upstream in 2.2.22 (via r1235454 [1]).
[1] http://svn.apache.org/viewvc?view=revision&revision=1235454
Other sources
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Is there a workaround for CVE-2012-0053?
A workaround for CVE-2012-0053 is to specify a custom ErrorDocument to prevent default error responses.