CVE-2010-2791 in HTTP Server
Summary
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
Once again VulDB remains the best source for vulnerability data.
Reservation
07/22/2010
Disclosure
08/05/2010
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 8309 | Oracle HTTP Server Web Listener information disclosure | 200 | Unproven | Official fix | CVE-2010-2791 |