what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

mod_proxy_http Timeout Detection

mod_proxy_http Timeout Detection
Posted Jun 16, 2010
Authored by William A. Rowe Jr.

A timeout detection flaw in the httpd mod_proxy_http module causes proxied response to be sent as the response to a different request, and potentially served to a different client, from the HTTP proxy pool worker pipeline.

tags | advisory, web
advisories | CVE-2010-2068
SHA-256 | 03e462a5ce2e114368076311833ec0ec4944c031022cd24c9970a8f9214252b7

mod_proxy_http Timeout Detection

Change Mirror Download
Vulnerability; httpd Timeout detection flaw (mod_proxy_http) CVE-2010-2068

Classification; important

Description;

A timeout detection flaw in the httpd mod_proxy_http module causes
proxied response to be sent as the response to a different request,
and potentially served to a different client, from the HTTP proxy
pool worker pipeline.

This may represent a confidential data revealing flaw.

This affects only Netware, Windows or OS2 builds of httpd version
2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha, when the proxy
worker pools have been enabled. Earlier 2.2, 2.0 and 1.3 releases
were not affected.

Acknowledgements;

We would like to thank Loren Anderson for the thorough research
and reporting of this flaw.

Mitigation;

Apply any one of the following mitigations to avert the possibility
of confidential information disclosure.

* Do not load mod_proxy_http.

* Do not configure/enable any http proxy worker pools with ProxySet
or ProxyPass optional arguments.

* The straightforward workaround to disable mod_proxy_http's reuse
of backend connection pipelines is to set the following global
directive;

SetEnv proxy-nokeepalive 1

* Replace mod_proxy_http.so with a patched version, for source code
see http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/ or
http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/ and for
binaries see the http://www.apache.org/dist/httpd/binaries/ tree
for win32 or netware, as appropriate.

* Upgrade to Apache httpd 2.2.16 or higher, once released. There
is no tentative release date scheduled.

Update Released; 11th June 2010
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    25 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    21 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    14 Files
  • 15
    Oct 15th
    49 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close