CVE-2009-0023
Published Jun 8, 2009
Last updated 9 months ago
Overview
- Description
- The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 4.3
- Impact score
- 2.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-119
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16176496-B955-4F98-A395-9709C927D9BC",
"versionEndIncluding": "1.3.4"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:0.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EC87975-74CA-42E6-84ED-0DD2BF9FFC78"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:0.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A896FA5-D3FC-4BD9-965A-C9A72D62780D"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:0.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8EDB1D0-82A9-462F-9B3B-0EDF452341E2"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:0.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9DFFEDC-F5C7-47C7-95A9-6BF4208A1B48"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:0.9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E87B09F2-ECEA-409D-B27B-0747280D4AC6"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67AB6223-9546-4906-B502-C82E3969FC76"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6459BE22-2334-48B3-85B8-5BEEB05A5399"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A24FB91C-33BC-4305-AD53-0385E3B3F091"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "617C8C4B-8367-4EFB-8DA1-88986F6CDACA"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D85D6B73-F2CB-427D-9896-6BA79BE96FB5"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39B4A447-29CC-4D35-B25D-FA845785E66B"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08B50283-4187-42F7-A2A3-F5789706708B"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40FD8140-F1E0-4F99-ACDA-926C0ACDC00E"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61D253E8-528E-47B3-887A-C540A8D91E0D"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD1CD8A7-6F0A-4BEB-8E8A-BEDAB71921E3"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1D0594C-E2FF-4557-80E6-8F51A4D94F7A"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E706184-E7BC-452F-82FE-72EA8C37F4D6"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "867962AD-8EF4-4DC4-96F6-77896CEF3F92"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EB78030-8C3B-4ACA-B62B-DC5DC5FBD073"
},
{
"criteria": "cpe:2.3:a:apache:apr-util:1.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E53CBDDE-D914-49A8-B65C-9352487B3CBA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BBBCFC4-2CFE-42A2-BE6F-2710EB3921A9",
"versionEndExcluding": "2.2.12",
"versionStartIncluding": "2.2.0"
}
],
"operator": "OR"
}
]
}
]