PT-2009-6671 · Debian · Yaws+5

Praveen Darshanam · Published 1970-01-01 · Updated 2017-09-29 · CVE-2009-0751

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions yaws versions prior to 1.80 yaws-chat (affected versions not specified) yaws-wiki (affected versions not specified) yaws-yapp (affected versions not specified) yaws-mail (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the yaws package of the Debian GNU/Linux operating system, which can lead to a disruption of protected information. These vulnerabilities can be exploited remotely. According to the information, a request with a large number of headers can cause a denial of service, resulting in memory consumption and a crash.

Recommendations For yaws versions prior to 1.80, update to version 1.80 or later to resolve the issue. For yaws-chat, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For yaws-wiki, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For yaws-yapp, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For yaws-mail, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-01931

BDU:2015-01932

BDU:2015-01933

BDU:2015-01934

BDU:2015-01935

CVE-2009-0751

DSA-1740-1

Affected Products

Debian

Yaws

Yaws-Chat

Yaws-Mail

Yaws-Wiki

Yaws-Yapp

References · 20

• 🔥 https://exploit-db.com/exploits/8148 · Exploit
• https://bdu.fstec.ru/vul/2015-01932 · Security Note
• https://bdu.fstec.ru/vul/2015-01931 · Security Note
• http://secunia.com/advisories/33979 · Vendor Advisory
• http://debian.org/security/2009/dsa-1740 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01933 · Security Note
• https://bdu.fstec.ru/vul/2015-01934 · Security Note
• https://osv.dev/vulnerability/CVE-2009-0751 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0751 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0751 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-0751 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01935 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0751 · Security Note
• http://yaws.hyber.org · Vendor Advisory
• http://vupen.com/english/advisories/2009/0590 · Note