PT-2009-4412 · Apache+1 · Apr-Util+2
Publicado
2009-04-24
·
Atualizado
2024-06-15
·
CVE-2009-1956
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:P |
Name of the Vulnerable Software and Affected Versions:
Apache APR-util versions prior to 1.3.5
Description:
The issue is related to an off-by-one error in the
apr brigade vprintf function on big-endian platforms. This error allows remote attackers to obtain sensitive information or cause a denial of service, resulting in an application crash, via crafted input. The flaw is due to the way the APR-util library processes a variable list of arguments, potentially leading to the disclosure of sensitive information or a denial of service.Recommendations:
For Apache APR-util versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting input to the
apr brigade vprintf function to minimize the risk of exploitation.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apr-Util
Apache Http Server
Red Hat