Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
Integer overflow in the approxysendfb function in proxy/proxyutil.c in modproxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
Apache with modrewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) modnegotiation, (2) moddir, or (3) modautoindex.
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
PHP 4.3.4 and earlier in Apache 1.x and 2.x (modphp) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
Cross-site scripting (XSS) vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
Additional problems were discovered in the httpd fix for CVE-2011-3368 - a reverse proxy bypass flaw - tracked via bug #740045. Upstream mailing list post identifies following request forms, which are not handled correctly:
GET @localhost::8880 HTTP/1.0\r\n\r\n GET qualys:@qqq.qq.qualys.com HTTP/1.0\r\n\r\n
Reference: http://thread.gmane.org/gmane.comp.apache.devel/46440
RMDG partner and independent security consultancy, "Context Information Security" has made CPNI Response aware of a security vulnerability which could potentially allow an attacker to gain full internal access to a network from the internet.
The technique exploits insecurely configured reverse web proxies to gain access to internal/DMZ systems.
This attack is based on an Apache web server which is using "modrewrite" to proxy web requests internally. Other proxies may suffer from this issue.
The vulnerability occurs if the Apache configuration file is configured like this:
RewriteRule ^(.) http://internalserver:80$1 [P]
As opposed to:
RewriteRule ^(.) http://internalserver:80/$1 [P]
It is important for readers to review their reverse proxy configurations to ensure that the rewrite rules are securely configured and cannot be abused in such a way that they can be used to compromise internal systems.