CVE-2009-3095
Fixed in a distro release EPSS 14%
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Products: apache http_server, fedoraproject fedora, debian_linux, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, apple mac_os_x
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.2.13-2 |
| Debian 13 | apache2 | 2.2.13-2 |
| Debian 14 | apache2 | 2.2.13-2 |
| Debian 4.0 | apache2 | 2.2.3-4+etch11 |
| Debian 5.0 | apache2 | 2.2.9-10+lenny6 |
| Red Hat certificate system 7.3 | ant | 0:1.6.5-1jpp_1rh |
| Red Hat certificate system 7.3 | avalon-logkit | 0:1.2-2jpp_4rh |
| Red Hat certificate system 7.3 | axis | 0:1.2.1-1jpp_3rh |
| Red Hat certificate system 7.3 | classpathx-jaf | 0:1.0-2jpp_6rh |
| Red Hat certificate system 7.3 | classpathx-mail | 0:1.1.1-2jpp_8rh |
| Red Hat certificate system 7.3 | geronimo-ejb-2.1-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-j2ee-1.4-apis | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-j2ee-connector-1.5-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-j2ee-deployment-1.1-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-j2ee-management-1.0-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-jms-1.1-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-jsp-2.0-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-jta-1.0.1B-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-servlet-2.4-api | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-specs | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | geronimo-specs-javadoc | 0:1.0-0.M4.1jpp_10rh |
| Red Hat certificate system 7.3 | jakarta-commons-modeler | 0:2.0-3jpp_2rh |
| Red Hat certificate system 7.3 | log4j | 0:1.2.12-1jpp_1rh |
| Red Hat certificate system 7.3 | mx4j | 1:3.0.1-1jpp_4rh |
| Red Hat certificate system 7.3 | pcsc-lite | 0:1.3.3-3.el4 |
| Red Hat certificate system 7.3 | pcsc-lite-debuginfo | 0:1.3.3-3.el4 |
| Red Hat certificate system 7.3 | pcsc-lite-doc | 0:1.3.3-3.el4 |
| Red Hat certificate system 7.3 | pcsc-lite-libs | 0:1.3.3-3.el4 |
| Red Hat certificate system 7.3 | rhpki-ca | 0:7.3.0-20.el4 |
| Red Hat certificate system 7.3 | rhpki-java-tools | 0:7.3.0-10.el4 |
| Red Hat certificate system 7.3 | rhpki-kra | 0:7.3.0-14.el4 |
| Red Hat certificate system 7.3 | rhpki-manage | 0:7.3.0-19.el4 |
| Red Hat certificate system 7.3 | rhpki-native-tools | 0:7.3.0-6.el4 |
| Red Hat certificate system 7.3 | rhpki-ocsp | 0:7.3.0-13.el4 |
| Red Hat certificate system 7.3 | rhpki-tks | 0:7.3.0-13.el4 |
| Red Hat certificate system 7.3 | tomcat5 | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | tomcat5-common-lib | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | tomcat5-jasper | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | tomcat5-jsp-2.0-api | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | tomcat5-server-lib | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | tomcat5-servlet-2.4-api | 0:5.5.23-0jpp_4rh.16 |
| Red Hat certificate system 7.3 | xerces-j2 | 0:2.7.1-1jpp_1rh |
| Red Hat certificate system 7.3 | xml-commons | 0:1.3.02-2jpp_1rh |
| Red Hat certificate system 7.3 | xml-commons-apis | 0:1.3.02-2jpp_1rh |
| Red Hat Enterprise Linux 3 | httpd | 0:2.0.46-77.ent |
| Red Hat Enterprise Linux 3 | httpd-debuginfo | 0:2.0.46-77.ent |
| Red Hat Enterprise Linux 3 | httpd-devel | 0:2.0.46-77.ent |
| Red Hat Enterprise Linux 3 | mod_ssl | 1:2.0.46-77.ent |
| Red Hat Enterprise Linux 4 | httpd | 0:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 4 | httpd-debuginfo | 0:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 4 | httpd-devel | 0:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 4 | httpd-manual | 0:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 4 | httpd-suexec | 0:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 4 | mod_ssl | 1:2.0.52-41.ent.6 |
| Red Hat Enterprise Linux 5 | httpd | 0:2.2.3-31.el5_4.2 |
| Red Hat Enterprise Linux 5 | httpd-debuginfo | 0:2.2.3-31.el5_4.2 |
| Red Hat Enterprise Linux 5 | httpd-devel | 0:2.2.3-31.el5_4.2 |
| Red Hat Enterprise Linux 5 | httpd-manual | 0:2.2.3-31.el5_4.2 |
| Red Hat Enterprise Linux 5 | mod_ssl | 1:2.2.3-31.el5_4.2 |
| Red Hat jboss enterprise web server 1 | httpd | 0:2.2.10-11.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd-devel | 0:2.2.10-11.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd-manual | 0:2.2.10-11.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd22 | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-devel | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-util | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-util-devel | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-debuginfo | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-devel | 0:2.2.10-25.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | mod_ssl | 1:2.2.10-11.ep5.el5 |
| Red Hat jboss enterprise web server 1 | mod_ssl22 | 1:2.2.10-25.1.ep5.el4 |
| Red Hat rhel application stack 2 | httpd | 0:2.2.13-2.el5s2 |
| Red Hat rhel application stack 2 | httpd-debuginfo | 0:2.2.13-2.el5s2 |
| Red Hat rhel application stack 2 | httpd-devel | 0:2.2.13-2.el5s2 |
| Red Hat rhel application stack 2 | httpd-manual | 0:2.2.13-2.el5s2 |
| Red Hat rhel application stack 2 | mod_ssl | 1:2.2.13-2.el5s2 |
| Red Hat rhel application stack 2 | mysql | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-bench | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-cluster | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-debuginfo | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-devel | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-libs | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-server | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | mysql-test | 0:5.0.84-2.el5s2 |
| Red Hat rhel application stack 2 | perl-DBD-MySQL | 0:4.012-1.el5s2 |
| Red Hat rhel application stack 2 | perl-DBD-MySQL-debuginfo | 0:4.012-1.el5s2 |
| Red Hat rhel application stack 2 | perl-DBI | 0:1.609-1.el5s2 |
| Red Hat rhel application stack 2 | perl-DBI-debuginfo | 0:1.609-1.el5s2 |
| Red Hat rhel application stack 2 | php | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-bcmath | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-cli | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-common | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-dba | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-debuginfo | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-devel | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-gd | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-imap | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-ldap | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-mbstring | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-mysql | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-ncurses | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-odbc | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-pdo | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-pear | 1:1.8.1-2.el5s2 |
| Red Hat rhel application stack 2 | php-pgsql | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-snmp | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-soap | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-xml | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | php-xmlrpc | 0:5.2.10-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-contrib | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-debuginfo | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-devel | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-docs | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-jdbc | 0:8.2.510-1jpp.el5s2 |
| Red Hat rhel application stack 2 | postgresql-jdbc-debuginfo | 0:8.2.510-1jpp.el5s2 |
| Red Hat rhel application stack 2 | postgresql-libs | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-plperl | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-plpython | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-pltcl | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-python | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-server | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-tcl | 0:8.2.14-1.el5s2 |
| Red Hat rhel application stack 2 | postgresql-test | 0:8.2.14-1.el5s2 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |