CVE-2009-3095
NoneCVSS
—
EPSS
13.5%
Published
Sep 8, 2009
CISA due date
—
The record
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | apache2 | 0 | 2.2.13-2 |
| Debian:11 | apache2 | 0 | 2.2.13-2 |
| Debian:12 | apache2 | 0 | 2.2.13-2 |
| Debian:13 | apache2 | 0 | 2.2.13-2 |
| Debian:4.0 | apache2 | 0 | 2.2.3-4+etch11 |
| Debian:5.0 | apache2 | 0 | 2.2.9-10+lenny6 |
| Red Hat:certificate_system:7.3 | ant | 0 | 0:1.6.5-1jpp_1rh |
| Red Hat:certificate_system:7.3 | avalon-logkit | 0 | 0:1.2-2jpp_4rh |
| Red Hat:certificate_system:7.3 | axis | 0 | 0:1.2.1-1jpp_3rh |
| Red Hat:certificate_system:7.3 | classpathx-jaf | 0 | 0:1.0-2jpp_6rh |
| Red Hat:certificate_system:7.3 | classpathx-mail | 0 | 0:1.1.1-2jpp_8rh |
| Red Hat:certificate_system:7.3 | geronimo-ejb-2.1-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-j2ee-1.4-apis | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-j2ee-connector-1.5-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-j2ee-deployment-1.1-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-j2ee-management-1.0-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-jms-1.1-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-jsp-2.0-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-jta-1.0.1B-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-servlet-2.4-api | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-specs | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | geronimo-specs-javadoc | 0 | 0:1.0-0.M4.1jpp_10rh |
| Red Hat:certificate_system:7.3 | jakarta-commons-modeler | 0 | 0:2.0-3jpp_2rh |
| Red Hat:certificate_system:7.3 | log4j | 0 | 0:1.2.12-1jpp_1rh |
| Red Hat:certificate_system:7.3 | mx4j | 0 | 1:3.0.1-1jpp_4rh |
| Red Hat:certificate_system:7.3 | pcsc-lite | 0 | 0:1.3.3-3.el4 |
| Red Hat:certificate_system:7.3 | pcsc-lite-debuginfo | 0 | 0:1.3.3-3.el4 |
| Red Hat:certificate_system:7.3 | pcsc-lite-doc | 0 | 0:1.3.3-3.el4 |
| Red Hat:certificate_system:7.3 | pcsc-lite-libs | 0 | 0:1.3.3-3.el4 |
| Red Hat:certificate_system:7.3 | rhpki-ca | 0 | 0:7.3.0-20.el4 |
| Red Hat:certificate_system:7.3 | rhpki-java-tools | 0 | 0:7.3.0-10.el4 |
| Red Hat:certificate_system:7.3 | rhpki-kra | 0 | 0:7.3.0-14.el4 |
| Red Hat:certificate_system:7.3 | rhpki-manage | 0 | 0:7.3.0-19.el4 |
| Red Hat:certificate_system:7.3 | rhpki-native-tools | 0 | 0:7.3.0-6.el4 |
| Red Hat:certificate_system:7.3 | rhpki-ocsp | 0 | 0:7.3.0-13.el4 |
| Red Hat:certificate_system:7.3 | rhpki-tks | 0 | 0:7.3.0-13.el4 |
| Red Hat:certificate_system:7.3 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat:certificate_system:7.3 | xerces-j2 | 0 | 0:2.7.1-1jpp_1rh |
| Red Hat:certificate_system:7.3 | xml-commons | 0 | 0:1.3.02-2jpp_1rh |
| Red Hat:certificate_system:7.3 | xml-commons-apis | 0 | 0:1.3.02-2jpp_1rh |
| Red Hat:enterprise_linux:3::as | httpd | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::as | httpd-debuginfo | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::as | httpd-devel | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::as | mod_ssl | 0 | 1:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::desktop | httpd | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::desktop | httpd-debuginfo | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::desktop | httpd-devel | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::desktop | mod_ssl | 0 | 1:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::es | httpd | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::es | httpd-debuginfo | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::es | httpd-devel | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::es | mod_ssl | 0 | 1:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::ws | httpd | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::ws | httpd-debuginfo | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::ws | httpd-devel | 0 | 0:2.0.46-77.ent |
| Red Hat:enterprise_linux:3::ws | mod_ssl | 0 | 1:2.0.46-77.ent |
| Red Hat:enterprise_linux:4::as | httpd | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::as | httpd-debuginfo | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::as | httpd-devel | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::as | httpd-manual | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::as | httpd-suexec | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::as | mod_ssl | 0 | 1:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | httpd | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | httpd-debuginfo | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | httpd-devel | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | httpd-manual | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | httpd-suexec | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::desktop | mod_ssl | 0 | 1:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | httpd | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | httpd-debuginfo | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | httpd-devel | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | httpd-manual | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | httpd-suexec | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::es | mod_ssl | 0 | 1:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | httpd | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | httpd-debuginfo | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | httpd-devel | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | httpd-manual | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | httpd-suexec | 0 | 0:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:4::ws | mod_ssl | 0 | 1:2.0.52-41.ent.6 |
| Red Hat:enterprise_linux:5::client | httpd | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client | httpd-debuginfo | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client | httpd-devel | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client | httpd-manual | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mod_ssl | 0 | 1:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | httpd | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-debuginfo | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-devel | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-manual | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mod_ssl | 0 | 1:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::server | httpd | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::server | httpd-debuginfo | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::server | httpd-devel | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::server | httpd-manual | 0 | 0:2.2.3-31.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mod_ssl | 0 | 1:2.2.3-31.el5_4.2 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22 | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-devel | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-util | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-util-devel | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-debuginfo | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-devel | 0 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_ssl22 | 0 | 1:2.2.10-25.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd | 0 | 0:2.2.10-11.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd-devel | 0 | 0:2.2.10-11.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd-manual | 0 | 0:2.2.10-11.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | mod_ssl | 0 | 1:2.2.10-11.ep5.el5 |
| Red Hat:rhel_application_stack:2 | httpd | 0 | 0:2.2.13-2.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-debuginfo | 0 | 0:2.2.13-2.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-devel | 0 | 0:2.2.13-2.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-manual | 0 | 0:2.2.13-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_ssl | 0 | 1:2.2.13-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-bench | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-cluster | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-debuginfo | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-devel | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-libs | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-server | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-test | 0 | 0:5.0.84-2.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBD-MySQL | 0 | 0:4.012-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBD-MySQL-debuginfo | 0 | 0:4.012-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBI | 0 | 0:1.609-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBI-debuginfo | 0 | 0:1.609-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-bcmath | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-cli | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-common | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-dba | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-debuginfo | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-devel | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-gd | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-imap | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-ldap | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-mbstring | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-mysql | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-ncurses | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-odbc | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-pdo | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-pear | 0 | 1:1.8.1-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-pgsql | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-snmp | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-soap | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-xml | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php-xmlrpc | 0 | 0:5.2.10-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-contrib | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-debuginfo | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-devel | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-docs | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-jdbc | 0 | 0:8.2.510-1jpp.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-jdbc-debuginfo | 0 | 0:8.2.510-1jpp.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-libs | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-plperl | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-plpython | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-pltcl | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-python | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-server | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-tcl | 0 | 0:8.2.14-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-test | 0 | 0:8.2.14-1.el5s2 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.23-4.1 |
Related vulnerabilities
- CVE-2015-0228 The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP… Also affects apache2
- CVE-2014-3583 The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the… Also affects apache2
- CVE-2013-4352 The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in… Also affects apache2
- CVE-2013-5704 The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass… Also affects apache2
- CVE-2013-1896 mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV… Also affects apache2
- CVE-2013-1862 mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25… Also affects apache2
- CVE-2012-3499 Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x… Also affects apache2
- CVE-2012-4558 Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in… Also affects apache2