VulnerabilityModified

CVE-2012-0053

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors…

MEDIUM 4.3EPSS 82.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 82.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 82.20% probability · 100th percentile
CISA KEV: Not listed
Affected: apache/http server · debian/debian linux · opensuse/opensuse · suse/linux enterprise server · suse/linux enterprise software development kit · redhat/storage · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux workstation · redhat/jboss enterprise web server
Source: secalert@redhat.com

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041Broken Link
http://httpd.apache.org/security/vulnerabilities_22.htmlVendor Advisory
http://kb.juniper.net/JSA10585Third Party Advisory
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlBroken Link, Mailing List
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133294460209056&w=2Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133494237717847&w=2Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133951357207000&w=2Issue Tracking, Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=136441204617335&w=2Issue Tracking, Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0128.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0542.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0543.htmlThird Party Advisory
http://secunia.com/advisories/48551Not Applicable
http://support.apple.com/kb/HT5501Third Party Advisory
http://svn.apache.org/viewvc?view=revision&revision=1235454Patch, Vendor Advisory
http://www.debian.org/security/2012/dsa-2405Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:012Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.htmlThird Party Advisory
http://www.securityfocus.com/bid/51706Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=785069Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.