Summary
This host is running Apache HTTP Server and is prone to cookie information disclosure vulnerability.
Impact
Successful exploitation will allow attackers to obtain sensitive information that may aid in further attacks.
Impact Level: Application
Solution
Upgrade to Apache HTTP Server version 2.2.22 or later, For updates refer to http://httpd.apache.org/
Insight
The flaw is due to an error within the default error response for status code 400 when no custom ErrorDocument is configured, which can be exploited to expose 'httpOnly' cookies.
Affected
Apache HTTP Server versions 2.2.0 through 2.2.21
References
- http://httpd.apache.org/security/vulnerabilities_22.html
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html
- http://osvdb.org/78556
- http://rhn.redhat.com/errata/RHSA-2012-0128.html
- http://secunia.com/advisories/47779
- http://svn.apache.org/viewvc?view=revision&revision=1235454
- http://www.exploit-db.com/exploits/18442
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2012-0053 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:P/I:N/A:N
Related Vulnerabilities