Vulnerability CVE-2011-3639


Published: 2011-11-29   Modified: 2012-02-13

Description:
The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Apache -> Http server 
Apache -> Http server2.0a1 
Apache -> Http server2.0a2 
Apache -> Http server2.0a3 
Apache -> Http server2.0a4 
Apache -> Http server2.0a5 
Apache -> Http server2.0a6 
Apache -> Http server2.0a7 
Apache -> Http server2.0a8 
Apache -> Http server2.0a9 

 References:
http://rhn.redhat.com/errata/RHSA-2012-0128.html
http://svn.apache.org/viewvc?view=revision&revision=1188745
http://www.debian.org/security/2012/dsa-2405
https://bugzilla.redhat.com/show_bug.cgi?id=752080

Copyright 2021, cxsecurity.com

 

Back to Top