// For flags

CVE-2009-2699

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.

La opción pollset de Solaris en el backend Event Port en poll/unix/port.c en la librería Apache Portable Runtime (APR) anterior v1.3.9, como los usados en Apache HTTP Server atenrior v2.2.14 y otros productos, no manejan adecuadamente los errores, lo que permite a atacantes remotos causar una denegación de servicio (bloqueo del demonio) a través de peticiones HTTP no especificadas, relativas el prefork y eventos MPMs.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-08-05 CVE Reserved
  • 2009-10-13 CVE Published
  • 2024-07-03 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-667: Improper Locking
CAPEC
References (20)
URL Tag Source
http://securitytracker.com/id?1022988 Broken Link
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/53666 Third Party Advisory
URL Date SRC
URL Date SRC
http://www.securityfocus.com/bid/36596 2024-02-15
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E 2024-02-15
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E 2024-02-15
URL Date SRC
http://marc.info/?l=bugtraq&m=133355494609819&w=2 2024-02-15
http://www.apache.org/dist/httpd/CHANGES_2.2.14 2024-02-15
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 2024-02-15
https://issues.apache.org/bugzilla/show_bug.cgi?id=47645 2024-02-15
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 >= 2.2.0 < 2.2.14
Search vendor "Apache" for product "Http Server" and version " >= 2.2.0 < 2.2.14"
-
Affected
Apache
Search vendor "Apache"
 Portable Runtime
Search vendor "Apache" for product "Portable Runtime"
 < 1.3.9
Search vendor "Apache" for product "Portable Runtime" and version " < 1.3.9"
-
Affected