Bug 632994 (CVE-2010-2068)

Summary:	CVE-2010-2068 httpd (mod_proxy): Sensitive response disclosure due improper handling of timeouts
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	pcheung, vdanen, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 12:58:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2010-09-12 11:26:15 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2068 to
the following vulnerability:

mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 
2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in 
certain configurations involving proxy worker pools, does not properly 
detect timeouts, which allows remote attackers to obtain a potentially 
sensitive response intended for a different client in opportunistic 
circumstances via a normal HTTP request. 

References:
[1] http://www.securityfocus.com/archive/1/archive/1/511809/100/0/threaded
[2] http://mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400@apache.org%3E
[3] http://marc.info/?l=apache-announce&m=128009718610929&w=2
[4] http://httpd.apache.org/security/vulnerabilities_22.html
[5] http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch
[6] http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch
[7] http://www.securityfocus.com/bid/40827
[8] http://securitytracker.com/id?1024096
[9] http://secunia.com/advisories/40206
[10] http://www.vupen.com/english/advisories/2010/1436
[11] http://xforce.iss.net/xforce/xfdb/59413

Comment 1 Jan Lieskovsky 2010-09-12 11:29:26 UTC

More information from upstream changeset [5]:

Only affects mod_proxy_http.c on Windows, Netware and OS2 platforms.

Is only triggered by proxy pools configured for timeouts shorter than the 
backend server response delay.

Only affects httpd versions 2.2.9 through 2.2.15, 2.3.4-alpha, 2.3.5-alpha.
Note that versions prior to 2.2.9 were not affected, including 1.3 and 2.0,
as the proxy worker pool feature was not yet introduced.

The straightforward workaround to disable mod_proxy_http's reuse of backend
connection pipelines is to set the following global directive;

 SetEnv proxy-nokeepalive 1

This workaround bypasses all ProxyPass/ProxySet pool options which trigger
connection pipelines, allowing them to remain in the configuration file
until the patched module can be deployed.

Comment 2 Jan Lieskovsky 2010-09-12 11:31:55 UTC

This issue affects the versions of the httpd package, as shipped 
with JBoss Enterprise Web Server v1.0.1 for Microsoft Windows
operating system.

Other versions of the httpd package, as shipped within various
Red Hat products are NOT affected by this issue.

Comment 3 errata-xmlrpc 2011-06-22 23:16:48 UTC

This issue has been addressed in following products:

  JBoss Enterprise Web Server 1.0

Via RHSA-2011:0896 https://rhn.redhat.com/errata/RHSA-2011-0896.html