This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. (CVE-2009-2412)

According to its self-reported banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.13. As such, it includes a bundled version of the Apache Portable Runtime (APR) library that contains a flaw in 'apr_palloc()' that could cause a heap overflow. 

Note that the Apache HTTP server itself does not pass unsanitized, user-provided sizes to this function so it could only be triggered through some other application that uses it in a vulnerable way.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1204 advisory.

    - add security fix for CVE-2009-2412 (#515709)

    apr-util:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The following bugs have been fixed : 

  - Integer overflows in libapr could potentially be     exploited to execute arbitrary code. (CVE-2009-2412)

  - Specially crafted XML documents cause apache to consume     large amounts of memory. (CVE-2009-1955)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

ID	Name	Product	Family	Published	Updated	Severity
42236	SuSE 10 Security Update : libapr (ZYPP Patch Number 6546)	Nessus	SuSE Local Security Checks	10/23/2009	1/14/2021	critical
57603	Apache 2.2.x < 2.2.13 APR apr_palloc Heap Overflow	Nessus	Web Servers	1/19/2012	6/29/2018	critical
67907	Oracle Linux 5 : apr / and / apr-util (ELSA-2009-1204)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
46217	SuSE9 Security Update : Apache 2 (YOU Patch Number 12613)	Nessus	SuSE Local Security Checks	5/4/2010	1/14/2021	critical
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	11/10/2009	3/6/2019	critical
800795	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	11/10/2009		high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high