CVE-2009-1195: apache http_server Configuration

Modified

AliasesDEBIAN-CVE-2009-1195DSA-1816-1

Published 28-05-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1195 is a medium (CVSS 4.9) Configuration vulnerability in apache http_server. EPSS estimates a 1.96% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 4.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.9/10

010

Medium · v2.0 (NVD)

EPSS score

1.96%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 1

OPENSUSE-SU-2024:10268-1 RHSA-2009:1075 RHSA-2009:1155 RHSA-2009:1156 RHSA-2009:1160

Timeline

28-05-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.

CVSS metrics

1 score · 1 source · 1 version

v2.04.9

EPSS trend

Probability

1.96%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.96% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (svn.apache.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-16ConfigurationWeaknesses in this category are typically introduced during the configuration of the software.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

http_serverEOL2.2.0 | 2.2.1 | 2.2.2 | 2.2.3 | 2.2.4 | 2.2.7 | 2.2.8 | 2.2.9 | 2.2.10

Debian1 product

apache2< 2.2.3-4+etch8 | < 2.2.9-10+lenny3 | < 2.2.11-6

2 vendors · 2 products

References

45 links

secunia.com/advisories/35261Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-1075.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8704VDB EntrySignatureX Refsource OVALThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/50808VDB EntryX Refsource XFThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-1156.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=489436X Refsource CONFIRMExploitIssue TrackingPatch
secunia.com/advisories/35395Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/37152Third Party AdvisoryX Refsource SECUNIA

Show all 45 references

osvdb.org/54733VDB EntryX Refsource OSVDBBroken Link
www.securityfocus.com/bid/35115VDB EntryX Refsource BIDThird Party Advisory
www.securityfocus.com/archive/1/507852/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/507857/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
secunia.com/advisories/35453Third Party AdvisoryX Refsource SECUNIA
svn.apache.org/viewvc?view=rev&revision=772997X Refsource CONFIRMExploitPatchVendor Advisory
security.gentoo.org/glsa/glsa-200907-04.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11094VDB EntrySignatureX Refsource OVALThird Party Advisory
www.securitytracker.com/id?1022296VDB EntryX Refsource SECTRACKThird Party Advisory
wiki.rpath.com/Advisories:rPSA-2009-0142X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/35264Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:124Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
marc.info?l=apache-httpd-dev&m=124048996106302&w=2Mailing ListX Refsource MLISTThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12377VDB EntrySignatureX Refsource OVALThird Party Advisory
www.vupen.com/english/advisories/2009/3184VDB EntryX Refsource VUPENThird Party Advisory
www.vupen.com/english/advisories/2009/1444VDB EntryX Refsource VUPENThird Party Advisory
lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing List
www.debian.org/security/2009/dsa-1816Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/35721Third Party AdvisoryX Refsource SECUNIA
support.apple.com/kb/HT3937X Refsource CONFIRMThird Party Advisory
www.ubuntu.com/usn/usn-787-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
security-tracker.debian.org/tracker/CVE-2009-1195Advisory