Apache Mod_Mem_Cache Information Disclosure Vulnerability

Bugtraq ID:	24553
Class:	Design Error
CVE:	CVE-2007-1862
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	Nov 15 2007 12:38AM
Credit:	Discovery is credited to Xuekun Hu <[email protected]>.
Vulnerable:	Red Hat Fedora Core7 Gentoo Linux Apache Software Foundation Apache 2.2.4
Not Vulnerable:	Apache Software Foundation Apache 2.2.5-dev

Apache Mod_Mem_Cache Information Disclosure Vulnerability

Apache is prone to a path-information-disclosure vulnerability. Remote unauthorized attackers may be able to access sensitive data.

Information obtained may aid attackers in launching further attacks against an affected server.

Apache 2.2.4 is reported vulnerable to this issue; other versions may be affected as well.

Apache Mod_Mem_Cache Information Disclosure Vulnerability

An attacker may use various common utilities to carry out this attack.

Apache Mod_Mem_Cache Information Disclosure Vulnerability

Solution:
The vendor released fixes to address this issue. Please see the references for more information.

Apache Mod_Mem_Cache Information Disclosure Vulnerability

References:

• Apache httpd 2.2 vulnerabilities (Apache Software Foundation)
  
• Apache Software Foundation Homepage (Apache Software Foundation)
  
• ASF Bugzilla Bug 41551 (Apache Software Foundation)
  
• Changes with Apache 2.2.5 (Apache Software Foundation)