CVE - CVE-2009-1195

CVE-ID
CVE-2009-1195	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1022296 URL:http://www.securitytracker.com/id?1022296 MISC:20091112 rPSA-2009-0142-1 httpd mod_ssl URL:http://www.securityfocus.com/archive/1/507852/100/0/threaded MISC:20091113 rPSA-2009-0142-2 httpd mod_ssl URL:http://www.securityfocus.com/archive/1/507857/100/0/threaded MISC:35115 URL:http://www.securityfocus.com/bid/35115 MISC:35261 URL:http://secunia.com/advisories/35261 MISC:35264 URL:http://secunia.com/advisories/35264 MISC:35395 URL:http://secunia.com/advisories/35395 MISC:35453 URL:http://secunia.com/advisories/35453 MISC:35721 URL:http://secunia.com/advisories/35721 MISC:37152 URL:http://secunia.com/advisories/37152 MISC:54733 URL:~~http://osvdb.org/54733~~ (Obsolete source) MISC:ADV-2009-1444 URL:~~http://www.vupen.com/english/advisories/2009/1444~~ (Obsolete source) MISC:ADV-2009-3184 URL:~~http://www.vupen.com/english/advisories/2009/3184~~ (Obsolete source) MISC:APPLE-SA-2009-11-09-1 URL:http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html MISC:DSA-1816 URL:http://www.debian.org/security/2009/dsa-1816 MISC:FEDORA-2009-8812 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html MISC:GLSA-200907-04 URL:http://security.gentoo.org/glsa/glsa-200907-04.xml MISC:HPSBUX02612 URL:http://marc.info/?l=bugtraq&m=129190899612998&w=2 MISC:MDVSA-2009:124 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2009:124~~ (Obsolete source) MISC:RHSA-2009:1075 URL:http://www.redhat.com/support/errata/RHSA-2009-1075.html MISC:RHSA-2009:1156 URL:http://www.redhat.com/support/errata/RHSA-2009-1156.html MISC:SSRT100345 URL:http://marc.info/?l=bugtraq&m=129190899612998&w=2 MISC:SUSE-SA:2009:050 URL:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html MISC:USN-787-1 URL:http://www.ubuntu.com/usn/usn-787-1 MISC:[apache-httpd-dev] 20090423 Includes vs IncludesNoExec security issue - help needed URL:http://marc.info/?l=apache-httpd-dev&m=124048996106302&w=2 MISC:[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ URL:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ URL:https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ URL:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ URL:https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ URL:https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E MISC:apache-allowoverrides-security-bypass(50808) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/50808 MISC:http://support.apple.com/kb/HT3937 URL:http://support.apple.com/kb/HT3937 MISC:http://svn.apache.org/viewvc?view=rev&revision=772997 URL:http://svn.apache.org/viewvc?view=rev&revision=772997 MISC:http://wiki.rpath.com/Advisories:rPSA-2009-0142 URL:http://wiki.rpath.com/Advisories:rPSA-2009-0142 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=489436 URL:https://bugzilla.redhat.com/show_bug.cgi?id=489436 MISC:oval:org.mitre.oval:def:11094 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11094 MISC:oval:org.mitre.oval:def:12377 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12377 MISC:oval:org.mitre.oval:def:8704 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8704
Assigning CNA
Red Hat, Inc.
Date Record Created
20090331	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20090331)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)