383
VMScore

CVE-2009-0023

Published: 08/06/2009 Updated: 11/10/2018
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util prior to 1.3.5 allows remote malicious users to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.

Vulnerable Product Search on Vulmon Subscribe to Product

apache apr-util 0.9.1

apache apr-util 0.9.2

apache apr-util 0.9.3

apache apr-util 0.9.4

apache apr-util 0.9.5

apache apr-util 1.0

apache apr-util 1.0.1

apache apr-util 1.0.2

apache apr-util 1.1.0

apache apr-util 1.1.1

apache apr-util 1.1.2

apache apr-util 1.2.1

apache apr-util 1.2.2

apache apr-util 1.2.6

apache apr-util 1.2.7

apache apr-util 1.2.8

apache apr-util 1.3.0

apache apr-util 1.3.1

apache apr-util 1.3.2

apache apr-util 1.3.3

apache apr-util

Vendor Advisories

Synopsis Moderate: apr-util security update Type/Severity Security Advisory: Moderate Topic Updated apr-util packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team ...
Synopsis Moderate: httpd security update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 3This update has been rated as having moderate security impact by the RedHat Security Response Team Descr ...
Apr-util, the Apache Portable Runtime Utility library, is used by Apache 2x, Subversion, and other applications Two denial of service vulnerabilities have been found in apr-util: "kcope" discovered a flaw in the handling of internal XML entities in the apr_xml_* interface that can be exploited to use all available memory This denial of service ...
Matthew Palmer discovered an underflow flaw in apr-util An attacker could cause a denial of service via application crash in Apache using a crafted SVNMasterURI directive, htaccess file, or when using mod_apreq2 Applications using libapreq2 are also affected (CVE-2009-0023) ...
Matthew Palmer discovered an underflow flaw in apr-util as included in Apache An attacker could cause a denial of service via application crash in Apache using a crafted SVNMasterURI directive, htaccess file, or when using mod_apreq2 This issue only affected Ubuntu 606 LTS (CVE-2009-0023) ...

References

CWE-119http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://marc.info/?l=bugtraq&m=129190899612998&w=2http://secunia.com/advisories/34724http://secunia.com/advisories/35284http://secunia.com/advisories/35360http://secunia.com/advisories/35395http://secunia.com/advisories/35444http://secunia.com/advisories/35487http://secunia.com/advisories/35565http://secunia.com/advisories/35710http://secunia.com/advisories/35797http://secunia.com/advisories/35843http://secunia.com/advisories/37221http://security.gentoo.org/glsa/glsa-200907-03.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210http://support.apple.com/kb/HT3937http://svn.apache.org/viewvc?view=rev&revision=779880http://wiki.rpath.com/Advisories:rPSA-2009-0144http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3http://www.debian.org/security/2009/dsa-1812http://www.mandriva.com/security/advisories?name=MDVSA-2009:131http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1107.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1108.htmlhttp://www.securityfocus.com/archive/1/507855/100/0/threadedhttp://www.securityfocus.com/bid/35221http://www.ubuntu.com/usn/usn-786-1http://www.ubuntu.com/usn/usn-787-1http://www.vupen.com/english/advisories/2009/1907http://www.vupen.com/english/advisories/2009/3184http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478http://www-01.ibm.com/support/docview.wss?uid=swg27014463https://bugzilla.redhat.com/show_bug.cgi?id=503928https://exchange.xforce.ibmcloud.com/vulnerabilities/50964https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10968https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12321https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.htmlhttps://www.rapid7.com/db/vulnerabilities/apple-osx-apache-cve-2009-0023https://access.redhat.com/errata/RHSA-2009:1107https://nvd.nist.govhttps://usn.ubuntu.com/786-1/https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2009-0023http://tools.cisco.com/security/center/viewAlert.x?alertId=20215