ID CVE-2009-1195
Summary The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
References
Vulnerable Configurations
  • Apache Software Foundation Apache HTTP Server
    cpe:2.3:a:apache:http_server
  • Apache Software Foundation Apache HTTP Server 2.2
    cpe:2.3:a:apache:http_server:2.2
  • Apache Software Foundation Apache HTTP Server 2.2.0
    cpe:2.3:a:apache:http_server:2.2.0
  • Apache Software Foundation Apache HTTP Server 2.2.1
    cpe:2.3:a:apache:http_server:2.2.1
  • Apache Software Foundation Apache HTTP Server 2.2.2
    cpe:2.3:a:apache:http_server:2.2.2
  • cpe:2.3:a:apache:http_server:2.2.2:-:windows
    cpe:2.3:a:apache:http_server:2.2.2:-:windows
  • Apache Software Foundation Apache HTTP Server 2.2.3
    cpe:2.3:a:apache:http_server:2.2.3
  • cpe:2.3:a:apache:http_server:2.2.3:-:windows
    cpe:2.3:a:apache:http_server:2.2.3:-:windows
  • Apache Software Foundation Apache HTTP Server 2.2.4
    cpe:2.3:a:apache:http_server:2.2.4
  • Apache Software Foundation Apache HTTP Server 2.2.6
    cpe:2.3:a:apache:http_server:2.2.6
  • cpe:2.3:a:apache:http_server:2.2.7
    cpe:2.3:a:apache:http_server:2.2.7
  • Apache Software Foundation Apache HTTP Server 2.2.8
    cpe:2.3:a:apache:http_server:2.2.8
  • Apache Software Foundation Apache HTTP Server 2.2.9
    cpe:2.3:a:apache:http_server:2.2.9
  • Apache Software Foundation Apache HTTP Server 2.2.10
    cpe:2.3:a:apache:http_server:2.2.10
  • Apache Software Foundation Apache HTTP Server 2.2.11
    cpe:2.3:a:apache:http_server:2.2.11
CVSS
Base: 4.9 (as of 29-05-2009 - 08:27)
Impact:
Exploitability:
CWE CWE-16
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20090527_HTTPD_ON_SL5_X.NASL
    description A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. (CVE-2008-1678) A flaw was found in the handling of the 'Options' and 'AllowOverride' directives. In configurations using the 'AllowOverride' directive with certain 'Options=' arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended. (CVE-2009-1195) Users must restart httpd for this update to take effect.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60591
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60591
    title Scientific Linux Security Update : httpd on SL5.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2009-1075.NASL
    description From Red Hat Security Advisory 2009:1075 : Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. (CVE-2008-1678) Note: The CVE-2008-1678 issue did not affect Red Hat Enterprise Linux 5 prior to 5.3. The problem was introduced via the RHBA-2009:0181 errata in Red Hat Enterprise Linux 5.3, which upgraded OpenSSL to the newer 0.9.8e version. A flaw was found in the handling of the 'Options' and 'AllowOverride' directives. In configurations using the 'AllowOverride' directive with certain 'Options=' arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended. (CVE-2009-1195) All httpd users should upgrade to these updated packages, which contain backported patches to resolve these issues. Users must restart httpd for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67866
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67866
    title Oracle Linux 5 : httpd (ELSA-2009-1075)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-787-1.NASL
    description Matthew Palmer discovered an underflow flaw in apr-util as included in Apache. An attacker could cause a denial of service via application crash in Apache using a crafted SVNMasterURI directive, .htaccess file, or when using mod_apreq2. This issue only affected Ubuntu 6.06 LTS. (CVE-2009-0023) Sander de Boer discovered that mod_proxy_ajp would reuse connections when a client closed a connection without sending a request body. A remote attacker could exploit this to obtain sensitive response data. This issue only affected Ubuntu 9.04. (CVE-2009-1191) Jonathan Peatfield discovered that Apache did not process Includes options correctly. With certain configurations of Options and AllowOverride, a local attacker could use an .htaccess file to override intended restrictions and execute arbitrary code via a Server-Side-Include file. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04. (CVE-2009-1195) It was discovered that the XML parser did not properly handle entity expansion. A remote attacker could cause a denial of service via memory resource consumption by sending a crafted request to an Apache server configured to use mod_dav or mod_dav_svn. This issue only affected Ubuntu 6.06 LTS. (CVE-2009-1955) C. Michael Pilato discovered an off-by-one buffer overflow in apr-util when formatting certain strings. For big-endian machines (powerpc, hppa and sparc in Ubuntu), a remote attacker could cause a denial of service or information disclosure leak. All other architectures for Ubuntu are not considered to be at risk. This issue only affected Ubuntu 6.06 LTS. (CVE-2009-1956). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 39371
    published 2009-06-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39371
    title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : apache2 vulnerabilities (USN-787-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_6_2.NASL
    description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2. Mac OS X 10.6.2 contains security fixes for the following products : - Adaptive Firewall - Apache - Apache Portable Runtime - Certificate Assistant - CoreMedia - CUPS - Dovecot - fetchmail - file - FTP Server - Help Viewer - ImageIO - IOKit - IPSec - Kernel - Launch Services - libsecurity - libxml - Login Window - OpenLDAP - QuickDraw Manager - QuickTime - Screen Sharing - Subversion
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 42434
    published 2009-11-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42434
    title Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2009-124.NASL
    description Multiple vulnerabilities has been found and corrected in apache : Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm (CVE-2008-1678). Note that this security issue does not really apply as zlib compression is not enabled in the openssl build provided by Mandriva, but apache is patched to address this issue anyway (conserns 2008.1 only). Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via wildcards in a pathname in an FTP URI (CVE-2008-2939). Note that this security issue was initially addressed with MDVSA-2008:195 but the patch fixing the issue was added but not applied in 2009.0. The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file (CVE-2009-1195). This update provides fixes for these vulnerabilities. Update : The patch for fixing CVE-2009-1195 for Mandriva Linux 2008.1 was incomplete, this update addresses the problem.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 39761
    published 2009-06-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39761
    title Mandriva Linux Security Advisory : apache (MDVSA-2009:124-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2009-006.NASL
    description The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied. This security update contains fixes for the following products : - AFP Client - Adaptive Firewall - Apache - Apache Portable Runtime - ATS - Certificate Assistant - CoreGraphics - CUPS - Dictionary - DirectoryService - Disk Images - Event Monitor - fetchmail - FTP Server - Help Viewer - International Components for Unicode - IOKit - IPSec - libsecurity - libxml - OpenLDAP - OpenSSH - PHP - QuickDraw Manager - QuickLook - FreeRADIUS - Screen Sharing - Spotlight - Subversion
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 42433
    published 2009-11-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42433
    title Mac OS X Multiple Vulnerabilities (Security Update 2009-006)
  • NASL family Web Servers
    NASL id WEBSPHERE_7_0_0_5.NASL
    description IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities : - Non-standard HTTP methods are allowed. (PK73246) - If the admin console is directly accessed from HTTP, the console fails to redirect the connection to a secure login page. (PK77010) - An error in Single Sign-on (SSO) with SPNEGO implementation could allow a remote attacker to bypass security restrictions. (PK77465) - 'wsadmin' is affected by a security exposure. (PK77495) - Security flag 'isSecurityEnabled' is incorrectly set after migrating from VMM. (PK78134) - Use of insecure password obfuscation algorithm by Web services could result in weaker than expected security provided the client module specifies a password in ibm-webservicesclient-bind.xmi and target environment has custom password encryption enabled. (PK79275) - After upgrading from WebSphere Application Server V6.1 to V7.0 with tracing enabled, an attacker may be able view sensitive information by viewing the trace files. (PK80337) - If CSIv2 Security is configured with Identity Assertion, it may be possible for a remote attacker to bypass security restrictions. (PK83097) - New applications deployed in WebSphere Application Server for z/OS prior to 1.8 are saved on the file system with insecure privileges resulting in disclosure of sensitive information. (PK83308) - Configservice APIs could display sensitive information. (PK84999) - Vulnerabilities in Apache HTTP server could allow a local user to gain elevated privileges. (PK86232) - A error in 'wsadmin' could allow a remote attacker to bypass security restrictions. (PK86328) - A vulnerability in portlet serving enable parameter could allow an attacker to bypass security restrictions and gain unauthorized access to the application. (PK89385)
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 40823
    published 2009-08-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40823
    title IBM WebSphere Application Server 7.0 < Fix Pack 5
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1816.NASL
    description It was discovered that the Apache web server did not properly handle the 'Options=' parameter to the AllowOverride directive : - In the stable distribution (lenny), local users could (via .htaccess) enable script execution in Server Side Includes even in configurations where the AllowOverride directive contained only Options=IncludesNoEXEC. - In the oldstable distribution (etch), local users could (via .htaccess) enable script execution in Server Side Includes and CGI script execution in configurations where the AllowOverride directive contained any 'Options=' value. The oldstable distribution (etch), this problem has been fixed in version 2.2.3-4+etch8.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 39439
    published 2009-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39439
    title Debian DSA-1816-1 : apache2 - insufficient security check
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVA-2009-095.NASL
    description The CVE-2009-1195 patch broke the mod_perl build. Patches from upstream svn has been applied to this update that fixes the issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 39357
    published 2009-06-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39357
    title MDVA-2009:095 : apache
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2009-1075.NASL
    description Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. (CVE-2008-1678) Note: The CVE-2008-1678 issue did not affect Red Hat Enterprise Linux 5 prior to 5.3. The problem was introduced via the RHBA-2009:0181 errata in Red Hat Enterprise Linux 5.3, which upgraded OpenSSL to the newer 0.9.8e version. A flaw was found in the handling of the 'Options' and 'AllowOverride' directives. In configurations using the 'AllowOverride' directive with certain 'Options=' arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended. (CVE-2009-1195) All httpd users should upgrade to these updated packages, which contain backported patches to resolve these issues. Users must restart httpd for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 38945
    published 2009-05-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=38945
    title RHEL 5 : httpd (RHSA-2009:1075)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_APACHE2-6571.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy. (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU. (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module. (CVE-2009-3095) Also a incompatibility between mod_cache and mod_rewrite was fixed.
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 42253
    published 2009-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42253
    title SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6571)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_APACHE2-091020.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy. (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU. (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module (CVE-2009-3095)
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 42252
    published 2009-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42252
    title SuSE 11 Security Update : Apache 2 (SAT Patch Number 1417)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2009-323.NASL
    description Multiple vulnerabilities has been found and corrected in apache : Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm (CVE-2008-1678). Note that this security issue does not really apply as zlib compression is not enabled in the openssl build provided by Mandriva, but apache is patched to address this issue anyway (conserns 2008.1 only). mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request (CVE-2009-1191). Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via wildcards in a pathname in an FTP URI (CVE-2008-2939). Note that this security issue was initially addressed with MDVSA-2008:195 but the patch fixing the issue was added but not applied in 2009.0. The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file (CVE-2009-1195). The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests (CVE-2009-1890). Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects (CVE-2009-1891). The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command (CVE-2009-3094). The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes (CVE-2009-3095). Apache is affected by SSL injection or man-in-the-middle attacks due to a design flaw in the SSL and/or TLS protocols. A short term solution was released Sat Nov 07 2009 by the ASF team to mitigate these problems. Apache will now reject in-session renegotiation (CVE-2009-3555). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers This update provides a solution to these vulnerabilities.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 43042
    published 2009-12-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43042
    title Mandriva Linux Security Advisory : apache (MDVSA-2009:323)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_0_APACHE2-091020.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module (CVE-2009-3095)
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 42245
    published 2009-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42245
    title openSUSE Security Update : apache2 (apache2-1419)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2009-1075.NASL
    description Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. (CVE-2008-1678) Note: The CVE-2008-1678 issue did not affect Red Hat Enterprise Linux 5 prior to 5.3. The problem was introduced via the RHBA-2009:0181 errata in Red Hat Enterprise Linux 5.3, which upgraded OpenSSL to the newer 0.9.8e version. A flaw was found in the handling of the 'Options' and 'AllowOverride' directives. In configurations using the 'AllowOverride' directive with certain 'Options=' arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended. (CVE-2009-1195) All httpd users should upgrade to these updated packages, which contain backported patches to resolve these issues. Users must restart httpd for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 43753
    published 2010-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43753
    title CentOS 5 : httpd (CESA-2009:1075)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_E15F2356913911DE8F42001AA0166822.NASL
    description Apache ChangeLog reports : CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules. CVE-2009-1195: Prevent the 'Includes' Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it. CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration. CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body. CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 40760
    published 2009-08-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40760
    title FreeBSD : apache22 -- several vulnerabilities (e15f2356-9139-11de-8f42-001aa0166822)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_APACHE2-091020.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module (CVE-2009-3095)
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 42248
    published 2009-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42248
    title openSUSE Security Update : apache2 (apache2-1419)
  • NASL family Web Servers
    NASL id APACHE_2_2_12.NASL
    description According to its banner, the version of Apache 2.2.x. running on the remote host is prior to 2.2.12. It is, therefore, affected by the following vulnerabilities : - A heap-based buffer underwrite flaw exists in the function 'apr_strmatch_precompile()' in the bundled copy of the APR-util library, which could be triggered when parsing configuration data to crash the daemon. (CVE-2009-0023) - A flaw in the mod_proxy_ajp module in version 2.2.11 only may allow a remote attacker to obtain sensitive response data intended for a client that sent an earlier POST request with no request body. (CVE-2009-1191) - The server does not limit the use of directives in a .htaccess file as expected based on directives such as 'AllowOverride' and 'Options' in the configuration file, which could enable a local user to bypass security restrictions. (CVE-2009-1195) - Failure to properly handle an amount of streamed data that exceeds the Content-Length value allows a remote attacker to force a proxy process to consume CPU time indefinitely when mod_proxy is used in a reverse proxy configuration. (CVE-2009-1890) - Failure of mod_deflate to stop compressing a file when the associated network connection is closed may allow a remote attacker to consume large amounts of CPU if there is a large (>10 MB) file available that has mod_deflate enabled. (CVE-2009-1891) - Using a specially crafted XML document with a large number of nested entities, a remote attacker may be able to consume an excessive amount of memory due to a flaw in the bundled expat XML parser used by the mod_dav and mod_dav_svn modules. (CVE-2009-1955) - There is an off-by-one overflow in the function 'apr_brigade_vprintf()' in the bundled copy of the APR-util library in the way it handles a variable list of arguments, which could be leveraged on big-endian platforms to perform information disclosure or denial of service attacks. (CVE-2009-1956) Note that Nessus has relied solely on the version in the Server response header and did not try to check for the issues themselves or even whether the affected modules are in use.
    last seen 2019-02-21
    modified 2018-09-17
    plugin id 40467
    published 2009-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40467
    title Apache 2.2.x < 2.2.12 Multiple Vulnerabilities
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2009-214-01.NASL
    description New httpd packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues.
    last seen 2018-09-01
    modified 2018-06-29
    plugin id 40459
    published 2009-08-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40459
    title Slackware 12.0 / 12.1 / 12.2 / current : httpd (SSA:2009-214-01)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2009-8812.NASL
    description This update includes the latest release of the Apache HTTP Server, version 2.2.13, fixing several security issues: * Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects. (CVE-2009-1891) * Prevent the 'Includes' Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it. (CVE-2009-1195) * Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration, where a remote attacker can force a proxy process to consume CPU time indefinitely. (CVE-2009-1890) * mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body. (CVE-2009-1191) Many bug fixes are also included; see the upstream changelog for further details: http://www.apache.org/dist/httpd/CHANGES_2.2.13 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 40833
    published 2009-09-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40833
    title Fedora 11 : httpd-2.2.13-1.fc11 (2009-8812)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_APACHE2-6572.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy. (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU. (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module. (CVE-2009-3095) Also a incompatibility between mod_cache and mod_rewrite was fixed.
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 49826
    published 2010-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49826
    title SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6572)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_APACHE2-6576.NASL
    description This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess (CVE-2009-1195) - mod_proxy could run into an infinite loop when used as reverse proxy (CVE-2009-1890) - mod_deflate continued to compress large files even after a network connection was closed, causing mod_deflate to consume large amounts of CPU (CVE-2009-1891) - The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. (CVE-2009-3094) - access restriction bypass in mod_proxy_ftp module (CVE-2009-3095)
    last seen 2019-02-21
    modified 2018-06-29
    plugin id 42319
    published 2009-10-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42319
    title openSUSE 10 Security Update : apache2 (apache2-6576)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200907-04.NASL
    description The remote host is affected by the vulnerability described in GLSA-200907-04 (Apache: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Apache HTTP server: Jonathan Peatfield reported that the 'Options=IncludesNoEXEC' argument to the 'AllowOverride' directive is not processed properly (CVE-2009-1195). Sander de Boer discovered that the AJP proxy module (mod_proxy_ajp) does not correctly handle POST requests that do not contain a request body (CVE-2009-1191). The vendor reported that the HTTP proxy module (mod_proxy_http), when being used as a reverse proxy, does not properly handle requests containing more data as stated in the 'Content-Length' header (CVE-2009-1890). Francois Guerraz discovered that mod_deflate does not abort the compression of large files even when the requesting connection is closed prematurely (CVE-2009-1891). Impact : A local attacker could circumvent restrictions put up by the server administrator and execute arbitrary commands with the privileges of the user running the Apache server. A remote attacker could send multiple requests to a server with the AJP proxy module, possibly resulting in the disclosure of a request intended for another client, or cause a Denial of Service by sending specially crafted requests to servers running mod_proxy_http or mod_deflate. Workaround : Remove 'include', 'proxy_ajp', 'proxy_http' and 'deflate' from APACHE2_MODULES in make.conf and rebuild Apache, or disable the aforementioned modules in the Apache configuration.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 39775
    published 2009-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39775
    title GLSA-200907-04 : Apache: Multiple vulnerabilities
oval via4
  • accepted 2013-04-29T04:11:29.205-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 5
      oval oval:org.mitre.oval:def:11414
    • comment The operating system installed on the system is CentOS Linux 5.x
      oval oval:org.mitre.oval:def:15802
    • comment Oracle Linux 5.x
      oval oval:org.mitre.oval:def:15459
    description The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
    family unix
    id oval:org.mitre.oval:def:11094
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
    version 18
  • accepted 2015-04-20T04:00:23.007-04:00
    class vulnerability
    contributors
    • name K, Balamurugan
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
    family unix
    id oval:org.mitre.oval:def:12377
    status accepted
    submitted 2011-02-01T12:25:58.000-05:00
    title HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Remote Denial of Service (DoS)
    version 45
  • accepted 2014-07-14T04:01:31.517-04:00
    class vulnerability
    contributors
    • name J. Daniel Brown
      organization DTCC
    • name Mike Lah
      organization The MITRE Corporation
    • name Shane Shaffer
      organization G2, Inc.
    • name Maria Mikhno
      organization ALTX-SOFT
    definition_extensions
    comment Apache HTTP Server 2.2.x is installed on the system
    oval oval:org.mitre.oval:def:8550
    description The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
    family windows
    id oval:org.mitre.oval:def:8704
    status accepted
    submitted 2010-03-08T17:30:00.000-05:00
    title Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
    version 11
redhat via4
advisories
  • bugzilla
    id 497077
    title memory leak in httpd
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment httpd is earlier than 0:2.2.3-22.el5_3.1
          oval oval:com.redhat.rhsa:tst:20091075002
        • comment httpd is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070556003
      • AND
        • comment httpd-devel is earlier than 0:2.2.3-22.el5_3.1
          oval oval:com.redhat.rhsa:tst:20091075006
        • comment httpd-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070556005
      • AND
        • comment httpd-manual is earlier than 0:2.2.3-22.el5_3.1
          oval oval:com.redhat.rhsa:tst:20091075004
        • comment httpd-manual is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070556009
      • AND
        • comment mod_ssl is earlier than 0:2.2.3-22.el5_3.1
          oval oval:com.redhat.rhsa:tst:20091075008
        • comment mod_ssl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070556007
    rhsa
    id RHSA-2009:1075
    released 2009-05-27
    severity Moderate
    title RHSA-2009:1075: httpd security update (Moderate)
  • rhsa
    id RHSA-2009:1156
rpms
  • httpd-0:2.2.3-22.el5_3.1
  • httpd-devel-0:2.2.3-22.el5_3.1
  • httpd-manual-0:2.2.3-22.el5_3.1
  • mod_ssl-0:2.2.3-22.el5_3.1
refmap via4
apple APPLE-SA-2009-11-09-1
bid 35115
bugtraq
  • 20091112 rPSA-2009-0142-1 httpd mod_ssl
  • 20091113 rPSA-2009-0142-2 httpd mod_ssl
confirm
debian DSA-1816
fedora FEDORA-2009-8812
gentoo GLSA-200907-04
hp
  • HPSBUX02612
  • SSRT100345
mandriva MDVSA-2009:124
mlist [apache-httpd-dev] 20090423 Includes vs IncludesNoExec security issue - help needed
osvdb 54733
sectrack 1022296
secunia
  • 35261
  • 35264
  • 35395
  • 35453
  • 35721
  • 37152
suse SUSE-SA:2009:050
ubuntu USN-787-1
vupen
  • ADV-2009-1444
  • ADV-2009-3184
xf apache-allowoverrides-security-bypass(50808)
Last major update 18-07-2011 - 22:26
Published 28-05-2009 - 16:30
Last modified 30-10-2018 - 12:25
Back to Top