PT-2009-3743 · Apache+1 · Apache Http Server+1

Published 2009-04-22 · Updated 2024-06-15 · CVE-2009-1195

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.11 and earlier 2.2 versions

Description The issue arises from the improper handling of Options=IncludesNOEXEC in the AllowOverride directive, allowing local users to gain privileges. This can be achieved by configuring certain options in a .htaccess file and then inserting an exec element in a .shtml file. The flaw affects configurations using the AllowOverride directive with specific Options arguments, enabling local users to execute commands from a Server-Side-Include script.

Recommendations For Apache HTTP Server versions 2.2.11 and earlier 2.2 versions, consider disabling the use of Options Includes, Options +Includes, or Options +IncludesNOEXEC in .htaccess files as a temporary workaround until a patch is available. Restrict access to the AllowOverride directive to minimize the risk of exploitation. Avoid using the exec element in .shtml files until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-1195

DSA-1816-1

HPSBUX02612

OPENSUSE-SU-2024:10268-1

RHSA-2009:1075

RHSA-2009:1155

RHSA-2009:1156

RHSA-2009:1160

RHSA-2009_1075

Affected Products

Apache Http Server

Red Hat

References · 121

• 🔥 http://svn.apache.org/viewvc?view=rev&revision=772997 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=489436 · Exploit
• http://secunia.com/advisories/35264 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956 · Security Note
• http://marc.info/?l=bugtraq&m=129190899612998&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1452 · Security Note
• https://osv.dev/vulnerability/CVE-2009-1195 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1195 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890 · Security Note