The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
http://intevydis.com/vd-list.shtml
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
http://marc.info/?l=bugtraq&m=126998684522511&w=2
http://marc.info/?l=bugtraq&m=127557640302499&w=2
http://marc.info/?l=bugtraq&m=130497311408250&w=2
http://marc.info/?l=bugtraq&m=133355494609819&w=2
http://secunia.com/advisories/37152
http://support.apple.com/kb/HT4077
http://wiki.rpath.com/Advisories:rPSA-2009-0155
http://www.debian.org/security/2009/dsa-1934
http://www.securityfocus.com/archive/1/508075/100/0/threaded
https://bugzilla.redhat.com/show_bug.cgi?id=522209
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html
Source: MITRE
Published: 2009-09-08
Updated: 2021-03-30
Type: NVD-CWE-Other
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
OR
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from 2.2.0 to 2.2.13 (inclusive)
OR
OR
OR
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
OR
ID | Name | Product | Family | Severity |
---|---|---|---|---|
67959 | Oracle Linux 4 : httpd (ELSA-2009-1580) | Nessus | Oracle Linux Local Security Checks | high |
67958 | Oracle Linux 3 / 5 : httpd (ELSA-2009-1579) | Nessus | Oracle Linux Local Security Checks | high |
67074 | CentOS 4 : httpd (CESA-2009:1580) | Nessus | CentOS Local Security Checks | high |
67073 | CentOS 3 / 5 : httpd (CESA-2009:1579) | Nessus | CentOS Local Security Checks | high |
60695 | Scientific Linux Security Update : httpd on SL3.x, SL4.x, SL5.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | high |
50069 | Apache 2.0.x < 2.0.64 Multiple Vulnerabilities | Nessus | Web Servers | high |
49826 | SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6572) | Nessus | SuSE Local Security Checks | high |
47168 | Fedora 11 : httpd-2.2.14-1.fc11 (2009-12747) | Nessus | Fedora Local Security Checks | high |
5489 | Mac OS X < 10.6.3 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
45373 | Mac OS X Multiple Vulnerabilities (Security Update 2010-002) | Nessus | MacOS X Local Security Checks | critical |
45372 | Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
44799 | Debian DSA-1934-1 : apache2 - multiple issues | Nessus | Debian Local Security Checks | high |
44120 | Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : httpd (SSA:2010-024-01) | Nessus | Slackware Local Security Checks | high |
43329 | Fedora 12 : httpd-2.2.14-1.fc12 (2009-12606) | Nessus | Fedora Local Security Checks | high |
43090 | Fedora 10 : httpd-2.2.14-1.fc10 (2009-12604) | Nessus | Fedora Local Security Checks | high |
43042 | Mandriva Linux Security Advisory : apache (MDVSA-2009:323) | Nessus | Mandriva Local Security Checks | high |
42858 | Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : apache2 vulnerabilities (USN-860-1) | Nessus | Ubuntu Local Security Checks | high |
42470 | RHEL 4 : httpd (RHSA-2009:1580) | Nessus | Red Hat Local Security Checks | high |
42469 | RHEL 3 / 5 : httpd (RHSA-2009:1579) | Nessus | Red Hat Local Security Checks | high |
42319 | openSUSE 10 Security Update : apache2 (apache2-6576) | Nessus | SuSE Local Security Checks | high |
42253 | SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6571) | Nessus | SuSE Local Security Checks | high |
42252 | SuSE 11 Security Update : Apache 2 (SAT Patch Number 1417) | Nessus | SuSE Local Security Checks | high |
42248 | openSUSE Security Update : apache2 (apache2-1419) | Nessus | SuSE Local Security Checks | high |
42245 | openSUSE Security Update : apache2 (apache2-1419) | Nessus | SuSE Local Security Checks | high |
42243 | SuSE9 Security Update : Apache 2 (YOU Patch Number 12526) | Nessus | SuSE Local Security Checks | high |
42052 | Apache 2.2.x < 2.2.14 Multiple Vulnerabilities | Nessus | Web Servers | high |
800574 | Apache < 2.2.14 Multiple Vulnerabilities | Log Correlation Engine | Web Servers | high |
5196 | Apache < 2.2.14 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | medium |
41049 | Mandriva Linux Security Advisory : apache (MDVSA-2009:240) | Nessus | Mandriva Local Security Checks | high |