My company's web server has recently failed our quarterly PCI scan on the basis of the Apache HTTPOnly Cookie Disclosure, a vulnerability only fixed from apache 2.2.22 onwards. I'm currently running Ubuntu 10.04 LTS with apache 2.2.14 and have searched high and low to find a repository for apache 2.2.22 compatible with 10.04LTS so that I may upgrade it with apt-get.

Does one exist?? Or do I need to manually update apache? Or do I need to upgrade to 12.04LTS in order to install apache 2.2.22?

Thanks a lot and I hope this helps some others out there, as I would imagine many other Techies have failed their quarterly PCI scans on the same basis!!


Presumably Paypal's quarterly scan is not due for a while.

From what I've been able to determine, the issue is that the cookie is not accessible by javascript - but it's value is exposed within the html body - so if you could inject javascript into the page then it could be captured - so exploitation is really dependant on a secondary attack vector.

Do PCI really publish a list of CERTs you must be compliant with?

Regardless, you can solve the problem by configuring an custom ErrorDocument for 400 errors - you should really not rely on the default pages for any error message.

  • Thanks. No, the PCI just ensure your scans return compliant from a verified scanner. Any vulnerabilities must be addressed. I'm about to be rescanned so hopefully your fix has done the job! – hav Aug 7 '12 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.