What’s Vulnerable › Vulnerabilities
CVE-2012-0053
- Severity: medium (CVSS 4.3 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 82.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2012-01-28 · updated 2026-06-16
Description
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
Affected products
- Apache HTTP Server: from 2.0.0 before 2.0.65; from 2.2.0 before 2.2.22 — fixed in 2.0.65, 2.2.22
- Debian Linux: 5.0, 6.0, 7.0
- Opensuse: 11.4
- RedHat Enterprise Linux Desktop: 6.0
- RedHat Enterprise Linux Eus: 6.2
- RedHat Enterprise Linux Server: 6.0
- RedHat Enterprise Linux Workstation: 6.0
- Red Hat JBoss Enterprise Web Server: 1.0.0
- RedHat Storage: 2.0
- SUSE Linux Enterprise Server: 10-sp4
- SUSE Linux Enterprise Software Development Kit: 10-sp4
How to fix
Upgrade to a fixed version: Apache HTTP Server 2.0.65, 2.2.22. Check the vendor advisory for mitigations.
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
- http://httpd.apache.org/security/vulnerabilities_22.html
- http://kb.juniper.net/JSA10585
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html
- http://marc.info/?l=bugtraq&m=133294460209056&w=2
- http://marc.info/?l=bugtraq&m=133494237717847&w=2
- http://marc.info/?l=bugtraq&m=133951357207000&w=2
- http://marc.info/?l=bugtraq&m=136441204617335&w=2
- http://rhn.redhat.com/errata/RHSA-2012-0128.html
- http://rhn.redhat.com/errata/RHSA-2012-0542.html
Get alerted when CVE-2012-0053 or the next vulnerability affects your stack