PT-2009-5423 · Apache+1 · Apache Http Server+1

Published 2009-09-03 · Updated 2024-06-15 · CVE-2009-3095

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (affected versions not specified)

Description: The issue allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server. This is achieved by embedding commands in the Authorization HTTP header. In a reverse proxy configuration, a remote attacker could use this flaw to bypass access restrictions by creating a carefully-crafted HTTP Authorization header.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2009-3095

DSA-1934-1

HPSBUX02531

OPENSUSE-SU-2024:10268-1

RHSA-2009:1461

RHSA-2009:1579

RHSA-2009:1580

RHSA-2009_1579

RHSA-2009_1580

RHSA-2010:0011

RHSA-2010:0602

Affected Products

Apache Http Server

Red Hat

References · 146

• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://bdu.fstec.ru/vul/2015-08549 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00645.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05276 · Security Note
• https://bdu.fstec.ru/vul/2015-07481 · Security Note
• https://bdu.fstec.ru/vul/2015-09647 · Security Note
• https://bdu.fstec.ru/vul/2015-05268 · Security Note
• https://bdu.fstec.ru/vul/2015-04272 · Security Note
• https://bdu.fstec.ru/vul/2015-05265 · Security Note
• https://bdu.fstec.ru/vul/2015-05274 · Security Note
• https://bdu.fstec.ru/vul/2015-05273 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3095 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3095 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3095 · Vendor Advisory