CVE-2009-0023

Published: Jun 8, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.

Affected (22)

Products: Apache: Apr Util, Http Server

Apache

2 products

Apr Util

Http Server

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Apache Apr Util	Up to 1.3.4
Apache Apr Util	Version 0.9.1
Apache Apr Util	Version 0.9.2
Apache Apr Util	Version 0.9.3
Apache Apr Util	Version 0.9.4
Apache Apr Util	Version 0.9.5
Apache Apr Util	Version 1.0.1
Apache Apr Util	Version 1.0.2
Apache Apr Util	Version 1.0
Apache Apr Util	Version 1.1.0
Apache Apr Util	Version 1.1.1
Apache Apr Util	Version 1.1.2
Apache Apr Util	Version 1.2.1
Apache Apr Util	Version 1.2.2
Apache Apr Util	Version 1.2.6
Apache Apr Util	Version 1.2.7
Apache Apr Util	Version 1.2.8
Apache Apr Util	Version 1.3.0
Apache Apr Util	Version 1.3.1
Apache Apr Util	Version 1.3.2
Apache Apr Util	Version 1.3.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.2.0 to 2.2.12

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (112)

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=129190899612998&w=2

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/34724

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35284

Source: secalert@redhat.com

Third Party AdvisoryVendor Advisory

http://secunia.com/advisories/35360

Source: secalert@redhat.com

Third Party AdvisoryVendor Advisory

http://secunia.com/advisories/35395

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35444

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35487

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35565

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35710

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35797

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35843

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/37221

Source: secalert@redhat.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200907-03.xml

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT3937

Source: secalert@redhat.com

Third Party Advisory

http://svn.apache.org/viewvc?view=rev&revision=779880

Source: secalert@redhat.com

Third Party Advisory

http://wiki.rpath.com/Advisories:rPSA-2009-0144

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg27014463

Source: secalert@redhat.com

Third Party Advisory

http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1812

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:131

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-1107.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-1108.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/507855/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/35221

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-786-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/usn-787-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1907

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/3184

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=503928

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/50964

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10968

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12321

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html