PT-2009-5089 · Apache+2 · Apache Http Server+3

Published 2009-09-23 · Updated 2024-06-15 · CVE-2009-2699

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime (APR) library versions prior to 1.3.9 Apache HTTP Server versions prior to 2.2.14

Description The issue is related to faulty error handling in the Solaris pollset feature of the Event Port backend in the APR library. This allows remote attackers to cause a denial of service, resulting in a daemon hang, via unspecified HTTP requests. The issue is specifically related to the prefork and event MPMs.

Recommendations For Apache Portable Runtime (APR) library versions prior to 1.3.9, update to version 1.3.9 or later. For Apache HTTP Server versions prior to 2.2.14, update to version 2.2.14 or later.

Fix

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2009-2699

OPENSUSE-SU-2024:10268-1

SUSE-SU-2017:2907-1

Affected Products

Apache Http Server

Apache Portable Runtime

Solaris

Suse

References · 86

• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Patch
• http://securityfocus.com/bid/36596 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2699 · Security Note
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E · Patch