Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability

Bugtraq ID:	42102
Class:	Unknown
CVE:	CVE-2010-2791
Remote:	Yes
Local:	No
Published:	Jul 30 2010 12:00AM
Updated:	Apr 16 2013 11:39PM
Credit:	Jeremy Sowden
Vulnerable:	rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Oracle HTTP Server 9.2 .8 Oracle Oracle HTTP Server 9.2 .0 + Apache Software Foundation Apache 1.3.22 Oracle Oracle HTTP Server 9.1 + Apache Software Foundation Apache 1.3.12 Oracle Oracle HTTP Server 9.0.3 .1 + Oracle Oracle9i Application Server 9.0.3 .1 Oracle Oracle HTTP Server 9.0.2 .3 + Oracle Oracle9i Application Server 9.0.2 .3 Oracle Oracle HTTP Server 9.0.2 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 + Apache Software Foundation Apache 1.3.12 + Oracle Oracle8 8.1.7 + Oracle Oracle8i Enterprise Edition 8.1.7 .0.0 + Oracle Oracle8i Standard Edition 8.1.7 Oracle Oracle HTTP Server 1.0.2 .2 Roll up 2 Oracle Oracle HTTP Server 1.0.2 .2 Oracle Oracle HTTP Server 1.0.2 .1 Oracle Oracle HTTP Server 1.0.2 .0 Oracle Oracle HTTP Server 11.1.1.5 Oracle Oracle HTTP Server 11.1.1.4 Oracle Oracle HTTP Server 11.1.1.3 Oracle Oracle HTTP Server 10.1.3.5 Oracle Oracle HTTP Server 10.1.2.3 Oracle HTTP Server for Server 9.2 Oracle HTTP Server for Server 9.0.1 Oracle HTTP Server for Server 8.1.7 HP System Management Homepage 6.2.2 7 HP System Management Homepage 6.0 .96 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 6.3 HP System Management Homepage 6.2.0-12 HP System Management Homepage 6.2 HP System Management Homepage 6.2 HP System Management Homepage 6.1.0.103 HP System Management Homepage 6.1.0.102 HP System Management Homepage 6.1.0-103 HP System Management Homepage 6.1 HP System Management Homepage 6.0.0.95 HP System Management Homepage 6.0.0-95 HP System Management Homepage 6.0 HP System Management Homepage 3.0.2.77 B HP System Management Homepage 3.0.2-77 HP System Management Homepage 3.0.1-73 HP System Management Homepage 3.0.0-68 HP System Management Homepage 0 Gentoo Linux Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Communication Manager 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 5.2 Apache Software Foundation Apache 2.2.9 + Adobe Flash Media Server 3.5.3 + Adobe Flash Media Server 3.5.2 + Adobe Flash Media Server 3.5.1
Not Vulnerable:	HP System Management Homepage 7.0 Apache Software Foundation Apache 2.2.10

Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability

References:

• Apache httpd 2.2 vulnerabilities (Apache Software Foundation)
  
• Apache Homepage (Apache Software Foundation)
  
• CVE-2010-2791: mod_proxy information leak affecting 2.2.9 only (Joe Orton)
  
• Revision 699841 (Apache Software Foundation)
  
• ASA-2010-235 httpd security and bug fix update (RHSA-2010-0659) (Avaya)