Back to search

Apache HTTPD: APR apr_palloc heap overflow (CVE-2009-2412)

Severity CVSS Published Added Modified
10 (AV:N/AC:L/Au:N/C:C/I:C/A:C) August 05, 2009 April 11, 2012 June 05, 2013

Description

The affected asset is vulnerable to this vulnerability ONLY if a non-Apache application can be passed unsanitized user-provided sizes to the apr_palloc() function. Review your web server configuration for validation. A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way.

Free Nexpose Download

Discover, prioritize, and remediate security risks today!

 Download now

References

Solution

apache-httpd-upgrade-2_0_64

Related Vulnerabilities