Vulnerability Details : CVE-2009-1191

mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
Publish Date : 2009-04-23 Last Update Date : 2013-04-17

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Related Tweets Even more tweets Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

Cvss Score	5.0
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	20

- Additional Vendor Supplied Data

Vendor	Impact	CVSS Score	CVSS Vector	Report Date	Publish Date
Redhat	important	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	2009-03-05	2009-04-21

If you are a vendor and you have additional data which can be automatically imported into our database, please contact admin @ cvedetails.com

- Related OVAL Definitions

Title	Definition Id	Class	Family
Apache 'mod_proxy_ajp' Information Disclosure Vulnerability	oval:org.mitre.oval:def:8261		windows
mod_proxy_ajp information disclosure	oval:org.apache.httpd:def:20091191

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2009-1191

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Apache	Apache Http Server	2.2.11				Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Apache	Apache Http Server	1

- References For CVE-2009-1191

http://www.securityfocus.com/bid/34663
BID 34663 Apache 'mod_proxy_ajp' Information Disclosure Vulnerability Release Date:2013-04-16

http://www.apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff CONFIRM

http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089 CONFIRM

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
APPLE APPLE-SA-2009-11-09-1

http://secunia.com/advisories/35395
SECUNIA 35395

http://xforce.iss.net/xforce/xfdb/50059
XF apache-modproxyajp-information-disclosure(50059)

http://www.vupen.com/english/advisories/2009/3184
VUPEN ADV-2009-3184

http://www.vupen.com/english/advisories/2009/1147
VUPEN ADV-2009-1147

http://www.ubuntu.com/usn/usn-787-1
UBUNTU USN-787-1

http://www.securitytracker.com/id?1022264
SECTRACK 1022264

http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html CONFIRM

http://security.gentoo.org/glsa/glsa-200907-04.xml
GENTOO GLSA-200907-04

http://secunia.com/advisories/35721
SECUNIA 35721

http://secunia.com/advisories/34827
SECUNIA 34827

http://www.mandriva.com/security/advisories?name=MDVSA-2009:102
MANDRIVA MDVSA-2009:102

http://support.apple.com/kb/HT3937 CONFIRM

http://osvdb.org/53921
OSVDB 53921

https://issues.apache.org/bugzilla/show_bug.cgi?id=46949 CONFIRM

- Metasploit Modules Related To CVE-2009-1191

There are not any metasploit modules related to this vulnerability (Please visit www.metasploit.com for more information)