// For flags

CVE-2010-0408

httpd: mod_proxy_ajp remote temporary DoS

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.

La función ap_proxy_ajp_request en mod_proxy_ajp.c en mod_proxy_ajp en the Apache HTTP Server v2.2.x en versiones anteriores a v2.2.15 no maneja adecuadamente ciertas situaciones en la cuales un cliente no envía el cuerpo de una petición, lo que permite a atacantes remotos producir una denegación de servicio (apagado del servidor del backend) a través de una petición manipulada, relacionado con el uso del código de error 500 en vez del código de error 400

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2010-01-27 CVE Reserved
  • 2010-03-05 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (45)
URL Tag Source
http://secunia.com/advisories/39100 Third Party Advisory
http://secunia.com/advisories/39501 Third Party Advisory
http://secunia.com/advisories/39628 Third Party Advisory
http://secunia.com/advisories/39632 Third Party Advisory
http://secunia.com/advisories/39656 Third Party Advisory
http://secunia.com/advisories/40096 Third Party Advisory
http://support.apple.com/kb/HT4435 Broken Link
http://svn.apache.org/viewvc?view=revision&revision=917876 Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Third Party Advisory
http://www.securityfocus.com/bid/38491 Broken Link
http://www.vupen.com/english/advisories/2010/0911 Broken Link
http://www.vupen.com/english/advisories/2010/0994 Broken Link
http://www.vupen.com/english/advisories/2010/1001 Broken Link
http://www.vupen.com/english/advisories/2010/1057 Broken Link
http://www.vupen.com/english/advisories/2010/1411 Broken Link
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8619 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9935 Broken Link
URL Date SRC
URL Date SRC
http://httpd.apache.org/security/vulnerabilities_22.html 2023-11-01
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_ajp.c?r1=917876&r2=917875&pathrev=917876 2023-11-01
URL Date SRC
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html 2023-11-01
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html 2023-11-01
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html 2023-11-01
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html 2023-11-01
http://marc.info/?l=bugtraq&m=127557640302499&w=2 2023-11-01
http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939 2023-11-01
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247 2023-11-01
http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829 2023-11-01
http://www.debian.org/security/2010/dsa-2035 2023-11-01
http://www.mandriva.com/security/advisories?name=MDVSA-2010:053 2023-11-01
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 2023-11-01
http://www.redhat.com/support/errata/RHSA-2010-0168.html 2023-11-01
https://bugzilla.redhat.com/show_bug.cgi?id=569905 2010-05-05
https://access.redhat.com/security/cve/CVE-2010-0408 2010-05-05
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2
Search vendor "Apache" for product "Http Server" and version "2.2"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.0
Search vendor "Apache" for product "Http Server" and version "2.2.0"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.2
Search vendor "Apache" for product "Http Server" and version "2.2.2"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.3
Search vendor "Apache" for product "Http Server" and version "2.2.3"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.4
Search vendor "Apache" for product "Http Server" and version "2.2.4"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.6
Search vendor "Apache" for product "Http Server" and version "2.2.6"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.8
Search vendor "Apache" for product "Http Server" and version "2.2.8"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.9
Search vendor "Apache" for product "Http Server" and version "2.2.9"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.11
Search vendor "Apache" for product "Http Server" and version "2.2.11"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.12
Search vendor "Apache" for product "Http Server" and version "2.2.12"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.13
Search vendor "Apache" for product "Http Server" and version "2.2.13"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.14
Search vendor "Apache" for product "Http Server" and version "2.2.14"
-
Affected