OSVDB ID: 85090

Title: Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure

Info

Disclosure

Aug 16, 2012

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Aug 16, 2012

Description

Apache HTTP Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the mod_proxy_ajp module in mod_proxy_ajp.c fails to properly close a back-end connection, which will disclose potentially information which was intended for a different client to a remote attacker.

Classification

Location: Remote / Network Access
Impact: Loss of Confidentiality
Solution: Patch / RCS, Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 2.4.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The Apache Software Foundation

Apache HTTP Server

2.4.0
2.4.1
2.4.2

References

Credit

Unknown or Incomplete



Direct URL: http://osvdb.org/85090