PT-2009-3090 · Ibm · Ibm Http Server

Published 2009-02-10 · Updated 2017-08-08 · CVE-2009-0436

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM HTTP Server versions 6.0.x through 6.0.2.30 IBM HTTP Server versions 6.1.x through 6.1.0.18

Description The mod ibm ssl and mod cgid modules in IBM HTTP Server set incorrect permissions for AF UNIX sockets. This issue has unknown impact and can be exploited through local attack vectors.

Recommendations For IBM HTTP Server versions 6.0.x through 6.0.2.30, update to version 6.0.2.31 or later. For IBM HTTP Server versions 6.1.x through 6.1.0.18, update to version 6.1.0.19 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0436

Affected Products

Ibm Http Server

References · 9

• http://www-01.ibm.com/support/docview.wss?uid=swg27006876 · Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg27008517 · Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg27007033 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-0436 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0436 · Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK66154 · Patch, Vendor Advisory
• http://securityfocus.com/bid/33700 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48526 · Note