Bug 632994 (CVE-2010-2068) - CVE-2010-2068 httpd (mod_proxy): Sensitive response disclosure due improper handling of timeouts
Summary: CVE-2010-2068 httpd (mod_proxy): Sensitive response disclosure due improper h...
Alias: CVE-2010-2068
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2010-09-12 11:26 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:39 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-07-29 12:58:07 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0896 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Web Server 1.0.2 update 2011-06-22 23:16:28 UTC

Description Jan Lieskovsky 2010-09-12 11:26:15 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2068 to
the following vulnerability:

mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 
2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in 
certain configurations involving proxy worker pools, does not properly 
detect timeouts, which allows remote attackers to obtain a potentially 
sensitive response intended for a different client in opportunistic 
circumstances via a normal HTTP request. 

[1] http://www.securityfocus.com/archive/1/archive/1/511809/100/0/threaded
[2] http://mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400@apache.org%3E
[3] http://marc.info/?l=apache-announce&m=128009718610929&w=2
[4] http://httpd.apache.org/security/vulnerabilities_22.html
[5] http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch
[6] http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch
[7] http://www.securityfocus.com/bid/40827
[8] http://securitytracker.com/id?1024096
[9] http://secunia.com/advisories/40206
[10] http://www.vupen.com/english/advisories/2010/1436
[11] http://xforce.iss.net/xforce/xfdb/59413

Comment 1 Jan Lieskovsky 2010-09-12 11:29:26 UTC
More information from upstream changeset [5]:

Only affects mod_proxy_http.c on Windows, Netware and OS2 platforms.

Is only triggered by proxy pools configured for timeouts shorter than the 
backend server response delay.

Only affects httpd versions 2.2.9 through 2.2.15, 2.3.4-alpha, 2.3.5-alpha.
Note that versions prior to 2.2.9 were not affected, including 1.3 and 2.0,
as the proxy worker pool feature was not yet introduced.

The straightforward workaround to disable mod_proxy_http's reuse of backend
connection pipelines is to set the following global directive;

 SetEnv proxy-nokeepalive 1

This workaround bypasses all ProxyPass/ProxySet pool options which trigger
connection pipelines, allowing them to remain in the configuration file
until the patched module can be deployed.

Comment 2 Jan Lieskovsky 2010-09-12 11:31:55 UTC
This issue affects the versions of the httpd package, as shipped 
with JBoss Enterprise Web Server v1.0.1 for Microsoft Windows
operating system.

Other versions of the httpd package, as shipped within various
Red Hat products are NOT affected by this issue.

Comment 3 errata-xmlrpc 2011-06-22 23:16:48 UTC
This issue has been addressed in following products:

  JBoss Enterprise Web Server 1.0

Via RHSA-2011:0896 https://rhn.redhat.com/errata/RHSA-2011-0896.html

Note You need to log in before you can comment on or make changes to this bug.