// For flags

CVE-2009-1195

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

Severity Score

9.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.

El Servidor HTTP de Apache v2.2.11 y anteriores a versiones 2.2 no maneja adecuadamente Options=IncludesNOEXEC en la directiva AllowOverride, lo que permite a usuarios locales obtener privilegios configurando (1) Options Includes, (2) Options +Includes, o (3) Options +IncludesNOEXEC en un fichero .htaccess, y después insertar un elemento exec en un fichero .shtml.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-03-31 CVE Reserved
  • 2009-05-28 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-16: Configuration
CAPEC
References (45)
URL Tag Source
http://marc.info/?l=apache-httpd-dev&m=124048996106302&w=2 Mailing List
http://osvdb.org/54733 Broken Link
http://secunia.com/advisories/35261 Third Party Advisory
http://secunia.com/advisories/35395 Third Party Advisory
http://secunia.com/advisories/35453 Third Party Advisory
http://secunia.com/advisories/35721 Third Party Advisory
http://secunia.com/advisories/37152 Third Party Advisory
http://support.apple.com/kb/HT3937 Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0142 Third Party Advisory
http://www.securityfocus.com/archive/1/507852/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/507857/100/0/threaded Mailing List
http://www.securityfocus.com/bid/35115 Third Party Advisory
http://www.securitytracker.com/id?1022296 Third Party Advisory
http://www.vupen.com/english/advisories/2009/1444 Third Party Advisory
http://www.vupen.com/english/advisories/2009/3184 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50808 Third Party Advisory
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11094 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12377 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8704 Signature
URL Date SRC
http://svn.apache.org/viewvc?view=rev&revision=772997 2024-08-07
https://bugzilla.redhat.com/show_bug.cgi?id=489436 2024-08-07
URL Date SRC
URL Date SRC
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html 2024-02-15
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html 2024-02-15
http://marc.info/?l=bugtraq&m=129190899612998&w=2 2024-02-15
http://secunia.com/advisories/35264 2024-02-15
http://security.gentoo.org/glsa/glsa-200907-04.xml 2024-02-15
http://www.debian.org/security/2009/dsa-1816 2024-02-15
http://www.mandriva.com/security/advisories?name=MDVSA-2009:124 2024-02-15
http://www.redhat.com/support/errata/RHSA-2009-1075.html 2024-02-15
http://www.redhat.com/support/errata/RHSA-2009-1156.html 2024-02-15
http://www.ubuntu.com/usn/usn-787-1 2024-02-15
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html 2024-02-15
https://access.redhat.com/security/cve/CVE-2009-1195 2009-07-17
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.0
Search vendor "Apache" for product "Http Server" and version "2.2.0"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.1
Search vendor "Apache" for product "Http Server" and version "2.2.1"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.2
Search vendor "Apache" for product "Http Server" and version "2.2.2"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.3
Search vendor "Apache" for product "Http Server" and version "2.2.3"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.4
Search vendor "Apache" for product "Http Server" and version "2.2.4"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.7
Search vendor "Apache" for product "Http Server" and version "2.2.7"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.8
Search vendor "Apache" for product "Http Server" and version "2.2.8"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.9
Search vendor "Apache" for product "Http Server" and version "2.2.9"
-
Affected
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 2.2.10
Search vendor "Apache" for product "Http Server" and version "2.2.10"
-
Affected