mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE:
this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. (CVE-2010-2791)

According to its banner, the version of Oracle HTTP Server installed on the remote host is potentially affected by multiple vulnerabilities. 

Note that Nessus did not verify if patches or workarounds have been applied.

From Red Hat Security Advisory 2010:0659 :

Updated httpd packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

A flaw was discovered in the way the mod_proxy module of the Apache HTTP Server handled the timeouts of requests forwarded by a reverse proxy to the back-end server. If the proxy was configured to reuse existing back-end connections, it could return a response intended for another user under certain timeout conditions, possibly leading to information disclosure. (CVE-2010-2791)

A flaw was found in the way the mod_dav module of the Apache HTTP Server handled certain requests. If a remote attacker were to send a carefully crafted request to the server, it could cause the httpd child process to crash. (CVE-2010-1452)

This update also fixes the following bugs :

* numerous issues in the INFLATE filter provided by mod_deflate.
'Inflate error -5 on flush' errors may have been logged. This update upgrades mod_deflate to the newer upstream version from Apache HTTP Server 2.2.15. (BZ#625435)

* the response would be corrupted if mod_filter applied the DEFLATE filter to a resource requiring a subrequest with an internal redirect.
(BZ#625451)

* the OID() function used in the mod_ssl 'SSLRequire' directive did not correctly evaluate extensions of an unknown type. (BZ#625452)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated httpd packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

A flaw was discovered in the way the mod_proxy module of the Apache HTTP Server handled the timeouts of requests forwarded by a reverse proxy to the back-end server. If the proxy was configured to reuse existing back-end connections, it could return a response intended for another user under certain timeout conditions, possibly leading to information disclosure. (CVE-2010-2791)

A flaw was found in the way the mod_dav module of the Apache HTTP Server handled certain requests. If a remote attacker were to send a carefully crafted request to the server, it could cause the httpd child process to crash. (CVE-2010-1452)

This update also fixes the following bugs :

* numerous issues in the INFLATE filter provided by mod_deflate.
'Inflate error -5 on flush' errors may have been logged. This update upgrades mod_deflate to the newer upstream version from Apache HTTP Server 2.2.15. (BZ#625435)

* the response would be corrupted if mod_filter applied the DEFLATE filter to a resource requiring a subrequest with an internal redirect.
(BZ#625451)

* the OID() function used in the mod_ssl 'SSLRequire' directive did not correctly evaluate extensions of an unknown type. (BZ#625452)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.0.  As such, it is reportedly affected by the following vulnerabilities :

 - An error exists in the 'generate-id' function in the    bundled libxslt library that can allow disclosure of    heap memory addresses. (CVE-2011-0195)

 - An unspecified input validation error exists and can    allow cross-site request forgery attacks. (CVE-2011-3846)

 - Unspecified errors can allow attackers to carry out    denial of service attacks via unspecified vectors.
   (CVE-2012-0135, CVE-2012-1993)

 - The bundled version of PHP contains multiple    vulnerabilities. (CVE-2010-3436, CVE-2010-4409,    CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,    CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,    CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,    CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,    CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)

 - The bundled version of Apache contains multiple    vulnerabilities. (CVE-2010-1452, CVE-2010-1623,    CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,    CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,    CVE-2011-3368, CVE-2011-3639)

 - OpenSSL libraries are contained in several of the    bundled components and contain multiple vulnerabilities.
   (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,    CVE-2011-3207,CVE-2011-3210)

 - Curl libraries are contained in several of the bundled    components and contain multiple vulnerabilities.
   (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-001 applied. 

This security update contains fixes for the following products :

  - Apache
  - bzip2
  - ClamAV
  - ImageIO
  - Kerberos
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - Ruby
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

The remote host is running HP System Management Homepage (HPSMH), a web-based interface for managing individual ProLiant and Integrity servers.

Versions of HP System Management Homepage earlier than 6.2 are potentially affected by the following vulnerabilities :

  - Session renegotiations are not handled properly, which could be exploited to insert arbitrary plaintext in a man-in-the-middle attack. (CVE-2009-3555)

  - An attacker may be able to upload files using a POST request with 'multipart/form-data' content even if the target script doesn't actually support file uploads per se. (CVE-2009-4017)

  - PHP's 'proc_open' function can be abused to bypass 'safe_mode_allowed_env_vars' and 'safe_mode_protected_env_vars' directives. (CVE-2009-4018)

  - PHP does not properly protect session data as relates to interrupt corruption of '$_SESSION' and the 'session.save_path' directive. (CVE-2009-4143)

  - An information disclosure vulnerability exists in Apache's mod_proxy_ajp, mod_reqtimeout, and mod_proxy_http relating to timeout conditions.  Note that this issue only affects HPSMH on Windows. (CVE-2010-2068)

  - An as-yet unspecified information disclosure vulnerability may allow an authorized user to gain access to sensitive information, which in turn could be leveraged to obtain root access on Linux installs of HPSMH. (CVE-2010-3009)

  - There is an as-yet unspecified XSS issue. (CVE-2010-3011)

  - There is an as-yet unspecified HTTP response splitting issue. (CVE-2010-3011)

According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 6.2.
Such versions are reportedly affected by the following vulnerabilities :

  - Session renegotiations are not handled properly, which     could be exploited to insert arbitrary plaintext in a     man-in-the-middle attack. (CVE-2009-3555)

  - An attacker may be able to upload files using a POST     request with 'multipart/form-data' content even if the     target script doesn't actually support file uploads per     se. (CVE-2009-4017)

  - PHP's 'proc_open' function can be abused to bypass     'safe_mode_allowed_env_vars' and     'safe_mode_protected_env_vars' directives.
    (CVE-2009-4018)

  - PHP does not properly protect session data as relates     to interrupt corruption of '$_SESSION' and the     'session.save_path' directive. (CVE-2009-4143)

  - The application allows arbitrary URL redirections.
    (CVE-2010-1586 and CVE-2010-3283)

  - An information disclosure vulnerability exists in     Apache's mod_proxy_ajp, mod_reqtimeout, and     mod_proxy_http relating to timeout conditions. Note     that this issue only affects SMH on Windows.
    (CVE-2010-2068)

  - An as-yet unspecified information disclosure     vulnerability may allow an authorized user to gain     access to sensitive information, which in turn could     be leveraged to obtain root access on Linux installs     of SMH. (CVE-2010-3009)

  - There is an as-yet unspecified HTTP response splitting     issue. (CVE-2010-3011)

  - There is an as-yet unspecified cross-site scripting     issue. (CVE-2010-3012)

  - An as-yet unspecified vulnerability could lead to     remote disclosure of sensitive information.
    (CVE-2010-3284)

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.16. It is, therefore, potentially affected by multiple vulnerabilities :

  - A denial of service vulnerability in mod_cache and     mod_dav. (CVE-2010-1452)   
  - An information disclosure vulnerability in mod_proxy_ajp,     mod_reqtimeout, and mod_proxy_http relating to timeout     conditions. Note that this issue only affects Apache on     Windows, Netware, and OS/2. (CVE-2010-2068)

Note that the remote web server may not actually be affected by these vulnerabilities.  Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

Versions of Apache 2.2 earlier than 2.2.16 are potentially affected by multiple vulnerabilities :

  - A denial-of-service vulnerability in mod_cache and mod_dav. (CVE-2010-1452)

  - An information disclosure vulnerability in mod_proxy_http relating to timeout conditions. (CVE-2010-2068)

ID	Name	Product	Family	Severity
87660	F5 Networks BIG-IP : Apache HTTPD vulnerability (K23332326)	Nessus	F5 Networks Local Security Checks	medium
69301	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities	Nessus	Web Servers	critical
68091	Oracle Linux 5 : httpd (ELSA-2010-0659)	Nessus	Oracle Linux Local Security Checks	medium
67078	CentOS 5 : httpd (CESA-2010:0659)	Nessus	CentOS Local Security Checks	medium
58811	HP System Management Homepage < 7.0 Multiple Vulnerabilities	Nessus	Web Servers	critical
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
52753	Mac OS X Multiple Vulnerabilities (Security Update 2011-001)	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
5667	HP System Management Homepage < 6.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
49272	HP System Management Homepage < 6.2 Multiple Vulnerabilities	Nessus	Web Servers	high
48934	RHEL 5 : httpd (RHSA-2010:0659)	Nessus	Red Hat Local Security Checks	medium
48205	Apache 2.2.x < 2.2.16 Multiple Vulnerabilities	Nessus	Web Servers	medium
800573	Apache 2.2 < 2.2.16 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
5615	Apache 2.2 < 2.2.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2010-2068

high

Tenable Plugins

medium

critical

medium

medium

critical

high

high

high

critical

high

high

medium

medium

high

medium