National Cyber-Alert System

Vulnerability Summary for CVE-2007-1862

Overview

The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.2.6. http://httpd.apache.org/security/vulnerabilities_22.html

Official Statement from Red Hat (06/11/2007)

Not vulnerable. This issue was specific to httpd version 2.2.4 and did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 2.1, 3, 4 or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2007-2727

Hyperlink:http://www.vupen.com/english/advisories/2007/2727

External Source: VUPEN

Name: ADV-2007-2231

Hyperlink:http://www.vupen.com/english/advisories/2007/2231

External Source: CONFIRM

Name: http://people.apache.org/~covener/2.2.x-mod_memcache-poolmgmt.diff

Hyperlink:http://people.apache.org/~covener/2.2.x-mod_memcache-poolmgmt.diff

External Source: OSVDB

Name: 38641

Hyperlink:http://osvdb.org/38641

External Source: CONFIRM

Name: http://issues.apache.org/bugzilla/show_bug.cgi?id=41551

Hyperlink:http://issues.apache.org/bugzilla/show_bug.cgi?id=41551

External Source: BID

Name: 24553

Hyperlink:http://www.securityfocus.com/bid/24553

External Source: FEDORA

Name: FEDORA-2007-2214

Hyperlink:http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html

External Source: MANDRIVA

Name: MDKSA-2007:127

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:127

External Source: GENTOO

Name: GLSA-200711-06

Hyperlink:http://security.gentoo.org/glsa/glsa-200711-06.xml

External Source: SECUNIA

Name: 27563

Hyperlink:http://secunia.com/advisories/27563

External Source: SECUNIA

Name: 26842

Hyperlink:http://secunia.com/advisories/26842

External Source: SECUNIA

Name: 26273

Hyperlink:http://secunia.com/advisories/26273

External Source: CONFIRM

Name: http://httpd.apache.org/security/vulnerabilities_22.html

Hyperlink:http://httpd.apache.org/security/vulnerabilities_22.html

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=186219

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=186219