NVD

Id
48487  
Name
CVE-2009-1195  
Description
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:N/I:N/A:C)  
Pub Date
2017-01-07  
Published
2009-05-28  
Modified Date
2011-07-18  
Seq
2009-1195  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
244414 48487 CVE-2009-1195 APPLE-SA-2009-11-09-1  View
244415 48487 CVE-2009-1195 SUSE-SA:2009:050  View
244416 48487 CVE-2009-1195 [apache-httpd-dev] 20090423 Includes vs IncludesNoExec security issue - help needed  View
244417 48487 CVE-2009-1195 HPSBUX02612  View
244418 48487 CVE-2009-1195 oval:org.mitre.oval:def:11094  View
244419 48487 CVE-2009-1195 oval:org.mitre.oval:def:12377  View
244420 48487 CVE-2009-1195 oval:org.mitre.oval:def:8704  View
244421 48487 CVE-2009-1195 GLSA-200907-04  View
244422 48487 CVE-2009-1195 http://support.apple.com/kb/HT3937  View
244423 48487 CVE-2009-1195 http://svn.apache.org/viewvc?view=rev&revision=772997  View
244424 48487 CVE-2009-1195 http://wiki.rpath.com/Advisories:rPSA-2009-0142  View
244425 48487 CVE-2009-1195 DSA-1816  View
244426 48487 CVE-2009-1195 MDVSA-2009:124  View
244427 48487 CVE-2009-1195 RHSA-2009:1075  View
244428 48487 CVE-2009-1195 RHSA-2009:1156  View
244429 48487 CVE-2009-1195 20091112 rPSA-2009-0142-1 httpd mod_ssl  View
244430 48487 CVE-2009-1195 20091113 rPSA-2009-0142-2 httpd mod_ssl  View
244431 48487 CVE-2009-1195 35115  View
244432 48487 CVE-2009-1195 1022296  View
244433 48487 CVE-2009-1195 USN-787-1  View
244434 48487 CVE-2009-1195 ADV-2009-1444  View
244435 48487 CVE-2009-1195 ADV-2009-3184  View
244436 48487 CVE-2009-1195 apache-allowoverrides-security-bypass(50808)  View
244437 48487 CVE-2009-1195 https://bugzilla.redhat.com/show_bug.cgi?id=489436  View
244438 48487 CVE-2009-1195 FEDORA-2009-8812  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40556 JVNDB-2009-001562 Apache HTTP Server における AllowOverride ディレクティブの処理に関する権限昇格の脆弱性 Apache HTTP Server には、AllowOverride ディレクティブの Options=IncludesNOEXEC を正しく処理しないため、.htaccess ファイル内の Options Includes、Options +Includes、および Options +IncludesNOEXEC の設定により権限を取得される脆弱性が存在します。 CVE-2009-1195 38626 CVE-2009-1195 48487 4.9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001562.html 2009-05-28 2011-05-19 View