CVEvulnerability

CVE-2009-3095

5.0 MEDIUM Published 2009-09-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-09-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

Affected configurations

• apache http server (>= 2.0.35 < 2.0.64) • apache http server (>= 2.2.0 < 2.2.14) • fedoraproject fedora 10 • fedoraproject fedora 12 • debian debian linux 4.0 • opensuse opensuse 10.3 • opensuse opensuse 11.0 • opensuse opensuse 11.1 • suse linux enterprise desktop 10 • suse linux enterprise server 9 • suse linux enterprise server 10 • suse linux enterprise server 11 • apple mac os x (< 10.6.3)

References