OSVDB ID: 85090

Title: Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure

Info

Disclosure
Aug 16, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Aug 16, 2012

Description

 Apache HTTP Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the mod_proxy_ajp module in mod_proxy_ajp.c fails to properly close a back-end connection, which will disclose potentially information which was intended for a different client to a remote attacker.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Patch / RCS, Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

 Upgrade to version 2.4.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The Apache Software Foundation

Apache HTTP Server

 2.4.0
2.4.1
2.4.2

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/85090