PT-2009-1194 · Apache+1 · Mod-Auth-Mysql+2

Martin Joey Schulze · Published 2009-01-22 · Updated 2018-10-30 · CVE-2008-2384

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server 2.x with mod-auth-mysql module

Description A SQL injection issue exists in the mod-auth-mysql module for the Apache HTTP Server, specifically in the mod auth mysql.c file. This occurs when the module is configured to use a multibyte character set that permits a backslash as part of the character encoding. As a result, remote attackers can execute arbitrary SQL commands by providing specially crafted inputs in a login request.

Recommendations For Apache HTTP Server 2.x with the mod-auth-mysql module, consider disabling the use of multibyte character sets that allow backslashes until a patch is available. Restrict access to the mod-auth-mysql module to minimize the risk of exploitation. Avoid using the backslash character in login requests to the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2384

RHSA-2009:0259

RHSA-2009_0259

RHSA-2010:1002

RHSA-2010_1002

Affected Products

Apache Http Server

Red Hat

Mod-Auth-Mysql

References · 20

• http://redhat.com/support/errata/RHSA-2010-1002.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053899.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2010-1002.html · Vendor Advisory
• http://secunia.com/advisories/33627 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0259.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053903.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2384 · Security Note
• http://klecker.debian.org/~white/mod-auth-mysql/CVE-2008-2384_mod-auth-mysql.patch · Patch
• http://vupen.com/english/advisories/2009/0226 · Note
• http://secunia.com/advisories/43302 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=480238 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48163 · Note
• http://openwall.com/lists/oss-security/2009/01/21/10 · Note
• https://access.redhat.com/security/cve/CVE-2008-2384 · Note
• http://vupen.com/english/advisories/2011/0367 · Note