CVE-2009-1955: High severity Apache apr-util vulnerability

Q: What is the severity of CVE-2009-1955?

CVE-2009-1955 has been classified as a moderate severity vulnerability due to its potential for causing denial of service by excessive memory consumption.

Q: How do I fix CVE-2009-1955?

To fix CVE-2009-1955, update the affected Apache APR-util package to version 1.3.7 or later.

Q: Which versions of Apache are affected by CVE-2009-1955?

CVE-2009-1955 affects Apache HTTP Server versions prior to 2.2.12 when using the vulnerable expat XML parser.

Q: Can CVE-2009-1955 be exploited remotely?

Yes, CVE-2009-1955 can be exploited remotely by sending a specially crafted XML document to the affected server.

Q: What components are affected by CVE-2009-1955 in Apache?

CVE-2009-1955 affects the expat XML parser utilized in the mod_dav and mod_dav_svn modules of Apache HTTP Server.

Published Jun 1, 2009

Updated

The expat XML parser in the aprxml interface in xml/aprxml.c in Apache APR-util before 1.3.7, as used in the moddav and moddavsvn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

Affected Software

24 affected componentsFixes available

redhat/httpd22<0:2.2.10-23.1.ep5.el4

0:2.2.10-23.1.ep5.el4

redhat/pcsc-lite<0:1.3.3-3.el4

0:1.3.3-3.el4

redhat/rhpki-ca<0:7.3.0-20.el4

0:7.3.0-20.el4

redhat/rhpki-java-tools<0:7.3.0-10.el4

0:7.3.0-10.el4

redhat/rhpki-kra<0:7.3.0-14.el4

0:7.3.0-14.el4

redhat/rhpki-manage<0:7.3.0-19.el4

0:7.3.0-19.el4

redhat/rhpki-native-tools<0:7.3.0-6.el4

0:7.3.0-6.el4

redhat/rhpki-ocsp<0:7.3.0-13.el4

0:7.3.0-13.el4

redhat/rhpki-tks<0:7.3.0-13.el4

0:7.3.0-13.el4

redhat/apr-util<0:0.9.4-22.el4_8.1

0:0.9.4-22.el4_8.1

redhat/apr-util<0:1.2.7-7.el5_3.1

0:1.2.7-7.el5_3.1

Apache apr-util<1.3.7

Apple iOS and macOS<10.6.2

SUSE Linux Enterprise Server=9

Debian Debian Linux=4.0

Canonical Ubuntu Linux=6.06

Canonical Ubuntu Linux=8.04

Canonical Ubuntu Linux=8.10

Canonical Ubuntu Linux=9.04

Fedoraproject Fedora=9

Fedoraproject Fedora=10

Fedoraproject Fedora=11

Oracle HTTP Server

Apache HTTP Server>=2.2.0<2.2.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/httpd22 to a version that resolves this vulnerability.
Fixed in 0:2.2.10-23.1.ep5.el4
Upgrade
Upgrade redhat/pcsc-lite to a version that resolves this vulnerability.
Fixed in 0:1.3.3-3.el4
Upgrade
Upgrade redhat/rhpki-ca to a version that resolves this vulnerability.
Fixed in 0:7.3.0-20.el4
Upgrade
Upgrade redhat/rhpki-java-tools to a version that resolves this vulnerability.
Fixed in 0:7.3.0-10.el4
Upgrade
Upgrade redhat/rhpki-kra to a version that resolves this vulnerability.
Fixed in 0:7.3.0-14.el4
Upgrade
Upgrade redhat/rhpki-manage to a version that resolves this vulnerability.
Fixed in 0:7.3.0-19.el4
Upgrade
Upgrade redhat/rhpki-native-tools to a version that resolves this vulnerability.
Fixed in 0:7.3.0-6.el4
Upgrade
Upgrade redhat/rhpki-ocsp to a version that resolves this vulnerability.
Fixed in 0:7.3.0-13.el4
Upgrade
Upgrade redhat/rhpki-tks to a version that resolves this vulnerability.
Fixed in 0:7.3.0-13.el4
Upgrade
Upgrade redhat/apr-util to a version that resolves this vulnerability.
Fixed in 0:0.9.4-22.el4_8.1
Upgrade
Upgrade redhat/apr-util to a version that resolves this vulnerability.
Fixed in 0:1.2.7-7.el5_3.1

Event History

Jun 1, 2009

CVE Published

12:00 AM

Jun 6, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2009-1955?

CVE-2009-1955 has been classified as a moderate severity vulnerability due to its potential for causing denial of service by excessive memory consumption.

How do I fix CVE-2009-1955?