mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://secunia.com/advisories/34827
http://secunia.com/advisories/35395
http://secunia.com/advisories/35721
http://security.gentoo.org/glsa/glsa-200907-04.xml
http://support.apple.com/kb/HT3937
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089
http://www.apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff
http://www.mandriva.com/security/advisories?name=MDVSA-2009:102
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
http://www.securityfocus.com/bid/34663
http://www.securitytracker.com/id?1022264
http://www.ubuntu.com/usn/usn-787-1
http://www.vupen.com/english/advisories/2009/1147
http://www.vupen.com/english/advisories/2009/3184
https://exchange.xforce.ibmcloud.com/vulnerabilities/50059
https://issues.apache.org/bugzilla/show_bug.cgi?id=46949
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8261
OR
ID | Name | Product | Family | Severity |
---|---|---|---|---|
48144 | Mandriva Linux Security Advisory : apache (MDVSA-2009:102) | Nessus | Mandriva Local Security Checks | medium |
43042 | Mandriva Linux Security Advisory : apache (MDVSA-2009:323) | Nessus | Mandriva Local Security Checks | high |
800795 | Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities | Log Correlation Engine | Operating System Detection | high |
5227 | Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
42434 | Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
42433 | Mac OS X Multiple Vulnerabilities (Security Update 2009-006) | Nessus | MacOS X Local Security Checks | critical |
40760 | FreeBSD : apache22 -- several vulnerabilities (e15f2356-9139-11de-8f42-001aa0166822) | Nessus | FreeBSD Local Security Checks | high |
800567 | Apache < 2.2.12 Multiple Vulnerabilities | Log Correlation Engine | Web Servers | medium |
5111 | Apache < 2.2.12 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | medium |
40459 | Slackware 12.0 / 12.1 / 12.2 / current : httpd (SSA:2009-214-01) | Nessus | Slackware Local Security Checks | high |
40467 | Apache 2.2.x < 2.2.12 Multiple Vulnerabilities | Nessus | Web Servers | high |
39775 | GLSA-200907-04 : Apache: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
39371 | Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : apache2 vulnerabilities (USN-787-1) | Nessus | Ubuntu Local Security Checks | high |