apache mod-mem-cache 2.2.4 recall-headers 信息泄漏漏洞

CVE编号

CVE-2007-1862

利用情况

暂无

补丁情况

N/A

披露时间

2007-06-05

漏洞描述

The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://bugs.gentoo.org/show_bug.cgi?id=186219
http://httpd.apache.org/security/vulnerabilities_22.html
http://issues.apache.org/bugzilla/show_bug.cgi?id=41551
http://osvdb.org/38641
http://people.apache.org/~covener/2.2.x-mod_memcache-poolmgmt.diff
http://secunia.com/advisories/26273
http://secunia.com/advisories/26842
http://secunia.com/advisories/27563
http://security.gentoo.org/glsa/glsa-200711-06.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:127
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html
http://www.securityfocus.com/bid/24553
http://www.vupen.com/english/advisories/2007/2231
http://www.vupen.com/english/advisories/2007/2727
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5...
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360...
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef...
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86...
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a...
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b...
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694...
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f...
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20...
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb...
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5...
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2b...
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f...
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806ce...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	apache	http_server	2.2.4	-
	运行在以下环境
	系统	suse_11	apache2	*		Up to (excluding) 2.2.10-2.24

CVSS3评分 5.0

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 无
• 保密性 部分地
• 完整性 无

AV:N/AC:L/Au:N/C:P/I:N/A:N CWE-ID 漏洞类型 NVD-CWE-Other