Permissions, Privileges, and Access Controls in Apache HTTP Server - CVE-2012-0053

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32827

Permissions, Privileges, and Access Controls in Apache HTTP Server - CVE-2012-0053

Published: January 28, 2012 / Updated: July 29, 2020


Vulnerability identifier: #VU32827
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-0053
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.


Affected software

Apache HTTP Server
HP OpenView Network Node Manager
Ubuntu
Slackware Linux
apache2 (Alpine package)
apache2.2-common (Ubuntu package)
HP-UX Web Server Suite

How to mitigate CVE-2012-0053

Install update from vendor's website.

Apache HTTP Server - update to 2.2.22
apache2 (Alpine package) - update to 2.2.22-r0
apache2.2-common (Ubuntu package) - addressed in versions 2.2.8-1ubuntu0.23, 2.2.14-5ubuntu8.8, 2.2.16-1ubuntu3.5, 2.2.17-1ubuntu1.5, 2.2.20-1ubuntu1.2
HP-UX Web Server Suite - addressed in versions 2.35, 3.23

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins