Published: 08/11/2011 Updated: 06/06/2021

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

VMScore: 448

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x up to and including 2.0.64 and 2.2.x up to and including 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server 2.0.61
apache http server 2.0.58
apache http server 2.0.53
apache http server 2.0.52
apache http server 2.0.44
apache http server 2.0.59
apache http server 2.0.32
apache http server 2.0.41
apache http server 2.0.40
apache http server 2.0.55
apache http server 2.0.54
apache http server 2.0.47
apache http server 2.0.46
apache http server 2.0.63
apache http server 2.0.9
apache http server 2.0.35
apache http server 2.0.34
apache http server 2.0.64
apache http server 2.0.51
apache http server 2.0.50
apache http server 2.0.43
apache http server 2.0.42
apache http server 2.0.45
apache http server 2.0.28
apache http server 2.0.39
apache http server 2.0.38
apache http server 2.0.57
apache http server 2.0.56
apache http server 2.0.49
apache http server 2.0.48
apache http server 2.0.60
apache http server 2.0
apache http server 2.0.37
apache http server 2.0.36
apache http server 2.2.8
apache http server 2.2.13
apache http server 2.2.4
apache http server 2.2.18
apache http server 2.2.3
apache http server 2.2.12
apache http server 2.2.14
apache http server 2.2.19
apache http server 2.2.9
apache http server 2.2.10
apache http server 2.2.15
apache http server 2.2.2
apache http server 2.2.1
apache http server 2.2.6
apache http server 2.2.11
apache http server 2.2.0
apache http server 2.2.16
apache http server 2.2.20
apache http server 2.2.21

Synopsis Moderate: httpd security update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability S ...

Synopsis Moderate: httpd security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues and one bug arenow available for JBoss Enterprise Web Server 102 for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated th ...

Synopsis Moderate: httpd security update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability S ...

Several security issues were fixed in the Apache HTTP Server ...

It was discovered that the fix for CVE-2011-3368 did not completely address the problem An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 09 request, or by using a specially-crafted URI (CVE-2011-3639, CVE-2011-4317) The httpd server include ...

Oracle Critical Patch Update Advisory - January 2015 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisor ...

Source: wwwhalfdognet/Security/2011/ApacheModSetEnvIfIntegerOverflow/ ## Background The Apache HTTP Server is an open-source HTTP server for modern operating systems including UNIX, Microsoft Windows, Mac OS/X and Netware The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services observi ...

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

repository ini digunakan untuk belajar

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Strike A python tool to quickly analyze all IPs and see which ones have open ports and vulnerabilities Installation apt-get install python3 git clone githubcom/SecureAxom/strike cd strike pip3 install -r requirementstxt python3 strikepy Usages python3 strikepy -h python3 strikepy -t 20891

Pigat：一款被动信息收集聚合工具前言 Pigat（Passive Intelligence Gathering Aggregation Tool）被动信息收集聚合工具，该工具通过爬取目标URL在第三方网站比如备案查询网站、子域名查询网站的结果来对目标进行被动信息收集。开发此工具的初衷就是平时在使用一些第三方的网站进行目标信息收�

pigat ( Passive Intelligence Gathering Aggregation Tool ) 被动信息收集聚合工具

Pigat：一款被动信息收集聚合工具前言 Pigat（Passive Intelligence Gathering Aggregation Tool）被动信息收集聚合工具，该工具通过爬取目标URL在第三方网站比如备案查询网站、子域名查询网站的结果来对目标进行被动信息收集。开发此工具的初衷就是平时在使用一些第三方的网站进行目标信息收�

whitehat nmap -sV --script vuln 192168123162 output Starting Nmap 793 ( nmaporg ) at 2022-12-25 15:11 EST Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 22400251 | After NULL UDP avahi packet DoS (CVE-2011-1002) |_ Hosts are all up (not vulnerable) Nmap scan report for 192168123162 Host is up (000025s latency) Not shown: 97

Домашнее задание к занятию 131 «Уязвимости и атаки на информационные системы» — Александр Гумлевой Задание 1 Скачайте и установите виртуальную машину Metasploitable: sourceforgenet/projects/metasploitable/ Это типовая

CVE-2011-3607

Vulnerability Summary

Most Upvoted Vulmon Research Post

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect