Red Hat Bugzilla – Bug 632994
CVE-2010-2068 httpd (mod_proxy): Sensitive response disclosure due improper handling of timeouts
Last modified: 2016-02-12 16:41:33 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2068 to the following vulnerability: mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. References: [1] http://www.securityfocus.com/archive/1/archive/1/511809/100/0/threaded [2] http://mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400@apache.org%3E [3] http://marc.info/?l=apache-announce&m=128009718610929&w=2 [4] http://httpd.apache.org/security/vulnerabilities_22.html [5] http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch [6] http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch [7] http://www.securityfocus.com/bid/40827 [8] http://securitytracker.com/id?1024096 [9] http://secunia.com/advisories/40206 [10] http://www.vupen.com/english/advisories/2010/1436 [11] http://xforce.iss.net/xforce/xfdb/59413
More information from upstream changeset [5]: Only affects mod_proxy_http.c on Windows, Netware and OS2 platforms. Is only triggered by proxy pools configured for timeouts shorter than the backend server response delay. Only affects httpd versions 2.2.9 through 2.2.15, 2.3.4-alpha, 2.3.5-alpha. Note that versions prior to 2.2.9 were not affected, including 1.3 and 2.0, as the proxy worker pool feature was not yet introduced. The straightforward workaround to disable mod_proxy_http's reuse of backend connection pipelines is to set the following global directive; SetEnv proxy-nokeepalive 1 This workaround bypasses all ProxyPass/ProxySet pool options which trigger connection pipelines, allowing them to remain in the configuration file until the patched module can be deployed.
This issue affects the versions of the httpd package, as shipped with JBoss Enterprise Web Server v1.0.1 for Microsoft Windows operating system. Other versions of the httpd package, as shipped within various Red Hat products are NOT affected by this issue.
This issue has been addressed in following products: JBoss Enterprise Web Server 1.0 Via RHSA-2011:0896 https://rhn.redhat.com/errata/RHSA-2011-0896.html