CVE - CVE-2009-0023

CVE-ID
CVE-2009-0023	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20091112 rPSA-2009-0144-1 apr-util URL:http://www.securityfocus.com/archive/1/507855/100/0/threaded MISC:34724 URL:http://secunia.com/advisories/34724 MISC:35221 URL:http://www.securityfocus.com/bid/35221 MISC:35284 URL:http://secunia.com/advisories/35284 MISC:35360 URL:http://secunia.com/advisories/35360 MISC:35395 URL:http://secunia.com/advisories/35395 MISC:35444 URL:http://secunia.com/advisories/35444 MISC:35487 URL:http://secunia.com/advisories/35487 MISC:35565 URL:http://secunia.com/advisories/35565 MISC:35710 URL:http://secunia.com/advisories/35710 MISC:35797 URL:http://secunia.com/advisories/35797 MISC:35843 URL:http://secunia.com/advisories/35843 MISC:37221 URL:http://secunia.com/advisories/37221 MISC:ADV-2009-1907 URL:~~http://www.vupen.com/english/advisories/2009/1907~~ (Obsolete source) MISC:ADV-2009-3184 URL:~~http://www.vupen.com/english/advisories/2009/3184~~ (Obsolete source) MISC:APPLE-SA-2009-11-09-1 URL:http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html MISC:DSA-1812 URL:http://www.debian.org/security/2009/dsa-1812 MISC:FEDORA-2009-5969 URL:https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html MISC:FEDORA-2009-6014 URL:https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html MISC:FEDORA-2009-6261 URL:https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html MISC:GLSA-200907-03 URL:http://security.gentoo.org/glsa/glsa-200907-03.xml MISC:HPSBUX02612 URL:http://marc.info/?l=bugtraq&m=129190899612998&w=2 MISC:MDVSA-2009:131 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2009:131~~ (Obsolete source) MISC:MDVSA-2013:150 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2013:150~~ (Obsolete source) MISC:PK88341 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341 MISC:PK91241 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241 MISC:PK99478 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478 MISC:RHSA-2009:1107 URL:http://www.redhat.com/support/errata/RHSA-2009-1107.html MISC:RHSA-2009:1108 URL:http://www.redhat.com/support/errata/RHSA-2009-1108.html MISC:SSA:2009-167-02 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210 MISC:SSRT100345 URL:http://marc.info/?l=bugtraq&m=129190899612998&w=2 MISC:USN-786-1 URL:http://www.ubuntu.com/usn/usn-786-1 MISC:USN-787-1 URL:http://www.ubuntu.com/usn/usn-787-1 MISC:[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ URL:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ URL:https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ URL:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ URL:https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ URL:https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210422 svn commit: r1074079 [2/3] - in /websites/staging/httpd/trunk/content: ./ apreq/ contribute/ contributors/ dev/ docs-project/ docs/ info/ mod_fcgid/ mod_ftp/ mod_mbox/ mod_smtpd/ modules/ security/ test/ test/flood/ URL:https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E MISC:[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html URL:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E MISC:apache-aprstrmatchprecompile-dos(50964) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/50964 MISC:http://support.apple.com/kb/HT3937 URL:http://support.apple.com/kb/HT3937 MISC:http://svn.apache.org/viewvc?view=rev&revision=779880 URL:http://svn.apache.org/viewvc?view=rev&revision=779880 MISC:http://wiki.rpath.com/Advisories:rPSA-2009-0144 URL:http://wiki.rpath.com/Advisories:rPSA-2009-0144 MISC:http://www-01.ibm.com/support/docview.wss?uid=swg27014463 URL:http://www-01.ibm.com/support/docview.wss?uid=swg27014463 MISC:http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 URL:http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 MISC:http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html URL:http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html MISC:https://bugzilla.redhat.com/show_bug.cgi?id=503928 URL:https://bugzilla.redhat.com/show_bug.cgi?id=503928 MISC:oval:org.mitre.oval:def:10968 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10968 MISC:oval:org.mitre.oval:def:12321 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12321
Assigning CNA
Red Hat, Inc.
Date Record Created
20081215	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20081215)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Site Map | Terms of Use | Privacy Policy | Contact Us | Follow CVE

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2023, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.