CVE-2008-2384

Published: Jan 22, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.

Affected (1)

Products: Joey Schulze: Mod Auth Mysql

1 product

Configuration A

1 vulnerable · 59 platform

Vulnerable Software	Affected Versions
Joey Schulze Mod Auth Mysql	All versions

Running on/with	Platform Versions
Apache Http Server	All versions
Apache Http Server	Version 2.0.28
Apache Http Server	Version 2.0.28 beta
Apache Http Server	Version 2.0.28 beta
Apache Http Server	Version 2.0.32
Apache Http Server	Version 2.0.32 beta
Apache Http Server	Version 2.0.32 beta
Apache Http Server	Version 2.0.34 beta
Apache Http Server	Version 2.0.34 beta
Apache Http Server	Version 2.0.35
Apache Http Server	Version 2.0.36
Apache Http Server	Version 2.0.37
Apache Http Server	Version 2.0.38
Apache Http Server	Version 2.0.39
Apache Http Server	Version 2.0.40
Apache Http Server	Version 2.0.41
Apache Http Server	Version 2.0.42
Apache Http Server	Version 2.0.43
Apache Http Server	Version 2.0.44
Apache Http Server	Version 2.0.45
Apache Http Server	Version 2.0.46
Apache Http Server	Version 2.0.46
Apache Http Server	Version 2.0.47
Apache Http Server	Version 2.0.48
Apache Http Server	Version 2.0.49
Apache Http Server	Version 2.0.50
Apache Http Server	Version 2.0.51
Apache Http Server	Version 2.0.52
Apache Http Server	Version 2.0.53
Apache Http Server	Version 2.0.54
Apache Http Server	Version 2.0.55
Apache Http Server	Version 2.0.56
Apache Http Server	Version 2.0.57
Apache Http Server	Version 2.0.58
Apache Http Server	Version 2.0.58
Apache Http Server	Version 2.0.59
Apache Http Server	Version 2.0.60
Apache Http Server	Version 2.0.61
Apache Http Server	Version 2.0.9
Apache Http Server	Version 2.0
Apache Http Server	Version 2.1.1
Apache Http Server	Version 2.1.2
Apache Http Server	Version 2.1.3
Apache Http Server	Version 2.1.4
Apache Http Server	Version 2.1.5
Apache Http Server	Version 2.1.6
Apache Http Server	Version 2.1.7
Apache Http Server	Version 2.1.8
Apache Http Server	Version 2.1
Apache Http Server	Version 2.2.0
Apache Http Server	Version 2.2.1
Apache Http Server	Version 2.2.2
Apache Http Server	Version 2.2.2
Apache Http Server	Version 2.2.3
Apache Http Server	Version 2.2.3
Apache Http Server	Version 2.2.4
Apache Http Server	Version 2.2.6
Apache Http Server	Version 2.2
Apache Http Server	Version 2.3.0

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (28)

http://klecker.debian.org/~white/mod-auth-mysql/CVE-2008-2384_mod-auth-mysql.patch

Source: cve@mitre.org

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053899.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053903.html

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2009/01/21/10

Source: cve@mitre.org

http://secunia.com/advisories/33627

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/43302

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0259.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2010-1002.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/33392

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0226

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/0367

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=480238

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/48163

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10172

Source: cve@mitre.org

http://klecker.debian.org/~white/mod-auth-mysql/CVE-2008-2384_mod-auth-mysql.patch

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053899.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053903.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2009/01/21/10

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33627

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43302

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0259.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-1002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33392

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0226

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0367

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=480238

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/48163

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10172

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.