PT-2009-5089 · Apache+2 · Apache Http Server+3

Publicado 2009-09-23 · Atualizado 2024-06-15 · CVE-2009-2699

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime (APR) library versions prior to 1.3.9 Apache HTTP Server versions prior to 2.2.14

Description The issue is related to faulty error handling in the Solaris pollset feature of the Event Port backend in the APR library. This allows remote attackers to cause a denial of service, resulting in a daemon hang, via unspecified HTTP requests. The issue is specifically related to the prefork and event MPMs.

Recommendations For Apache Portable Runtime (APR) library versions prior to 1.3.9, update to version 1.3.9 or later. For Apache HTTP Server versions prior to 2.2.14, update to version 2.2.14 or later.

Correção

DoS

Improper Locking

Enumeração de Fraquezas

CWE-667

Identificadores relacionados

CVE-2009-2699

OPENSUSE-SU-2024:10268-1

SUSE-SU-2017:2907-1

Produtos afetados

Apache Http Server

Apache Portable Runtime

Solaris

Suse

Referências · 86

• http://securitytracker.com/id?1022988 · Nota
• https://suse.com/security/cve/CVE-2015-0228 · Nota
• https://suse.com/security/cve/CVE-2014-3581 · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Correção
• https://suse.com/security/cve/CVE-2009-1955 · Nota
• http://securityfocus.com/bid/36596 · Correção
• https://suse.com/security/cve/CVE-2011-3607 · Nota
• https://suse.com/security/cve/CVE-2013-5704 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2699 · Nota de Segurança
• https://suse.com/security/cve/CVE-2009-1956 · Nota
• https://suse.com/security/cve/CVE-2009-3094 · Nota
• https://suse.com/security/cve/CVE-2011-3192 · Nota
• https://suse.com/security/cve/CVE-2009-0023 · Nota
• https://suse.com/security/cve/CVE-2014-0118 · Nota
• https://suse.com/security/cve/CVE-2009-3560 · Nota