What’s Vulnerable › Vulnerabilities

CVE-2009-3095

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-09-08 · updated 2026-06-16

Description

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

Affected products

• Apache HTTP Server: from 2.0.35 before 2.0.64; from 2.2.0 before 2.2.14 — fixed in 2.0.64, 2.2.14
• macOS: before 10.6.3 — fixed in 10.6.3
• Debian Linux: 4.0
• Fedoraproject Fedora: 10, 12
• Opensuse: 10.3, 11.0, 11.1
• SUSE Linux Enterprise Server 15 SP1: 10-sp2, 10-sp3
• SUSE Linux Enterprise Server: 9, 10-sp2, 10-sp3, 11

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.64, 2.2.14; macOS 10.6.3. Check the vendor advisory for mitigations.

References

• http://intevydis.com/vd-list.shtml
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
• http://marc.info/?l=bugtraq&m=126998684522511&w=2
• http://marc.info/?l=bugtraq&m=127557640302499&w=2
• http://marc.info/?l=bugtraq&m=130497311408250&w=2
• http://marc.info/?l=bugtraq&m=133355494609819&w=2
• http://secunia.com/advisories/37152
• http://support.apple.com/kb/HT4077
• http://wiki.rpath.com/Advisories:rPSA-2009-0155
• http://www.debian.org/security/2009/dsa-1934
• http://www.securityfocus.com/archive/1/508075/100/0/threaded

Get alerted when CVE-2009-3095 or the next vulnerability affects your stack