Apache < 2.2.15 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.15. Such versions are potentially affected by multiple vulnerabilities :

• A TLS renegotiation prefix attack is possible. (CVE-2009-3555)

• The ‘mod_proxy_ajp’ module returns the wrong status code if it encounters an error which causes the back-end server to be put into an error state. (CVE-2010-0408)

• The ‘mod_isapi’ module attempts to unload the ‘ISAPI.DLL’ when it encounters various error states which could leave call-backs in an undefined state. (CVE-2010-0425)

• A flaw in the core sub-request process code can lead to sensitive information from a request being handled by the wrong thread if a multi-threaded environment is used. (CVE-2010-0434)

IAVA Reference : 2011-A-0107
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I