Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.1
CVSSv2

CVE-2009-1891

Published: 10/07/2009 Updated: 13/02/2023
CVSS v2 Base Score: 7.1 | Impact Score: 6.9 | Exploitability Score: 8.6
VMScore: 636
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Subscribe to Http Server

Vulnerability Summary

The mod_deflate module in Apache httpd 2.2.11 and previous versions compresses large files until completion even after the associated network connection is closed, which allows remote malicious users to cause a denial of service (CPU consumption).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

debian debian linux 5.0

debian debian linux 4.0

debian debian linux 6.0

fedoraproject fedora 11

canonical ubuntu linux 9.04

canonical ubuntu linux 8.10

canonical ubuntu linux 8.04

canonical ubuntu linux 6.06

redhat enterprise linux server 5.0

redhat enterprise linux workstation 5.0

redhat enterprise linux desktop 5.0

redhat enterprise linux server aus 5.3

redhat enterprise linux eus 5.3

Vendor Advisories

Red Hat: Important: httpd security update
Synopsis Important: httpd security update Type/Severity Security Advisory: Important Topic Updated httpd packages that fix two security issues are now available forRed Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team Descrip ...
Red Hat: Important: httpd security update
Synopsis Important: httpd security update Type/Severity Security Advisory: Important Topic Updated httpd packages that fix multiple security issues are now availablefor JBoss Enterprise Web Server 100 for Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedH ...
Ubuntu Security Notice: apache2 regression
USN-802-1 fixed vulnerabilities in Apache The upstream fix for CVE-2009-1891 introduced a regression that would cause Apache children to occasionally segfault when mod_deflate is used This update fixes the problem ...
Ubuntu Security Notice: apache2 vulnerabilities
It was discovered that mod_proxy_http did not properly handle a large amount of streamed data when used as a reverse proxy A remote attacker could exploit this and cause a denial of service via memory resource consumption This issue affected Ubuntu 804 LTS, 810 and 904 (CVE-2009-1890) ...
Debian Security Advisories: DSA-1834-1 apache2 -- denial of service
CVE-2009-1890 A denial of service flaw was found in the Apache mod_proxy module when it was used as a reverse proxy A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time This issue did not affect Debian 40 "etch" CVE-2009-1891 A denial of service flaw was found in the Apache mod_deflate module This ...
Debian CVElist Bug Report Logs: apache2: CVE-2009-1890 denial-of-service vulnerability
Debian Bug report logs - #536718 apache2: CVE-2009-1890 denial-of-service vulnerability Package: apache2; Maintainer for apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache2 is src:apache2 (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: ...
Debian CVElist Bug Report Logs: apache2.2-common: DOS possible with mod_deflate
Debian Bug report logs - #534712 apache22-common: DOS possible with mod_deflate Package: apache22-common; Maintainer for apache22-common is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache22-common is src:apache2 (PTS, buildd, popcon) Reported by: François Guerraz <kubrick@fgv6net> ...
Debian CVElist Bug Report Logs: CVE-2009-3094, CVE-2009-3095: mod_proxy_ftp DoS
Debian Bug report logs - #545951 CVE-2009-3094, CVE-2009-3095: mod_proxy_ftp DoS Package: apache22-common; Maintainer for apache22-common is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache22-common is src:apache2 (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit&gt ...

References

CWE-400http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712http://www.mandriva.com/security/advisories?name=MDVSA-2009:149https://bugzilla.redhat.com/show_bug.cgi?id=509125http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2https://rhn.redhat.com/errata/RHSA-2009-1148.htmlhttp://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2http://secunia.com/advisories/35865http://www.debian.org/security/2009/dsa-1834http://www.redhat.com/support/errata/RHSA-2009-1156.htmlhttp://www.securitytracker.com/id?1022529http://secunia.com/advisories/35781http://secunia.com/advisories/35793http://secunia.com/advisories/35721http://www.vupen.com/english/advisories/2009/1841http://security.gentoo.org/glsa/glsa-200907-04.xmlhttp://osvdb.org/55782http://www.ubuntu.com/usn/USN-802-1https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.htmlhttp://secunia.com/advisories/37152http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlhttp://support.apple.com/kb/HT3937http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://www.vupen.com/english/advisories/2009/3184http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361http://secunia.com/advisories/37221http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142http://wiki.rpath.com/Advisories:rPSA-2009-0142http://marc.info/?l=bugtraq&m=129190899612998&w=2http://marc.info/?l=bugtraq&m=130497311408250&w=2https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361http://www.securityfocus.com/archive/1/507857/100/0/threadedhttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2009:1148https://nvd.nist.govhttps://usn.ubuntu.com/802-2/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook