CVE-2009-2412: allocator alignment fixes Full details here:
http://www.apache.org/dist/apr/patches/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-813-1 fixed vulnerabilities in apr. This update provides the corresponding updates for apr-util.

Matt Lewis discovered that apr did not properly sanitize its input when allocating memory. If an application using apr processed crafted input, a remote attacker could cause a denial of service or potentially execute arbitrary code as the user invoking the application.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated apr and apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It aims to provide a free library of C data structures and routines. apr-util is a utility library used with APR. This library provides additional utility interfaces for APR; including support for XML parsing, LDAP, database interfaces, URI parsing, and more.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the Apache Portable Runtime (APR) manages memory pool and relocatable memory allocations. An attacker could use these flaws to issue a specially crafted request for memory allocation, which would lead to a denial of service (application crash) or, potentially, execute arbitrary code with the privileges of an application using the APR libraries. (CVE-2009-2412)

All apr and apr-util users should upgrade to these updated packages, which contain backported patches to correct these issues. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect.

The following bugs have been fixed : 

  - Integer overflows in libapr could potentially be     exploited to execute arbitrary code. (CVE-2009-2412)

  - Specially crafted XML documents cause apache to consume     large amounts of memory. (CVE-2009-1955)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

ID	Name	Product	Family	Published	Updated	Severity
40514	Fedora 11 : apr-1.3.8-1.fc11 (2009-8336)	Nessus	Fedora Local Security Checks	8/10/2009	1/11/2021	critical
40531	Ubuntu 8.04 LTS / 8.10 / 9.04 : apr-util vulnerability (USN-813-3)	Nessus	Ubuntu Local Security Checks	8/10/2009	1/19/2021	critical
40542	RHEL 4 / 5 : apr and apr-util (RHSA-2009:1204)	Nessus	Red Hat Local Security Checks	8/11/2009	1/14/2021	critical
46217	SuSE9 Security Update : Apache 2 (YOU Patch Number 12613)	Nessus	SuSE Local Security Checks	5/4/2010	1/14/2021	critical
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	11/10/2009	3/6/2019	critical
800795	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	11/10/2009		high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high