Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company's web server has recently failed our quarterly PCI scan on the basis of the Apache HTTPOnly Cookie Disclosure, a vulnerability only fixed from apache 2.2.22 onwards. I'm currently running Ubuntu 10.04 LTS with apache 2.2.14 and have searched high and low to find a repository for apache 2.2.22 compatible with 10.04LTS so that I may upgrade it with apt-get.

Does one exist?? Or do I need to manually update apache? Or do I need to upgrade to 12.04LTS in order to install apache 2.2.22?

Thanks a lot and I hope this helps some others out there, as I would imagine many other Techies have failed their quarterly PCI scans on the same basis!!

share|improve this question

Presumably Paypal's quarterly scan is not due for a while.

From what I've been able to determine, the issue is that the cookie is not accessible by javascript - but it's value is exposed within the html body - so if you could inject javascript into the page then it could be captured - so exploitation is really dependant on a secondary attack vector.

Do PCI really publish a list of CERTs you must be compliant with?

Regardless, you can solve the problem by configuring an custom ErrorDocument for 400 errors - you should really not rely on the default pages for any error message.

share|improve this answer
Thanks. No, the PCI just ensure your scans return compliant from a verified scanner. Any vulnerabilities must be addressed. I'm about to be rescanned so hopefully your fix has done the job! – hav Aug 7 '12 at 12:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.