CVE-2009-3095

Опубликовано: 08 сент. 2009

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

Ссылки

http://intevydis.com/vd-list.shtml
Broken Link
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=126998684522511&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=126998684522511&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=130497311408250&w=2
Not Applicable
Third Party Advisory
http://marc.info/?l=bugtraq&m=130497311408250&w=2
Not Applicable
Third Party Advisory
http://marc.info/?l=bugtraq&m=133355494609819&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=133355494609819&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://secunia.com/advisories/37152
Not Applicable
Third Party Advisory
http://support.apple.com/kb/HT4077
Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0155
Broken Link
http://www.debian.org/security/2009/dsa-1934
Third Party Advisory
http://www.securityfocus.com/archive/1/508075/100/0/threaded
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=522209
Issue Tracking
Third Party Advisory
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.0.35 (включая) до 2.0.64 (исключая)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.2.14 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия до 10.6.3 (исключая)

EPSS

Процентиль: 88%

0.03989

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2009-3095

ubuntu

почти 16 лет назад

CVE-2009-3095

redhat

почти 16 лет назад

CVE-2009-3095

debian

почти 16 лет назад

The mod_proxy_ftp module in the Apache HTTP Server allows remote attac ...

GHSA-w532-9px6-hv54

github

около 3 лет назад

ELSA-2009-1579

oracle-oval

больше 15 лет назад

ELSA-2009-1579: httpd security update (MODERATE)

EPSS

Процентиль: 88%

0.03989

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other