ID

VAR-201111-0190


CVE

CVE-2011-3607


TITLE

Apache HTTP Server ‘ ap_pregsub() ‘function local privilege escalation vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-201111-112

DESCRIPTION

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. Apache HTTP Server is prone to a local privilege-escalation vulnerability because of an integer-overflow error. Local attackers can exploit this issue to run arbitrary code with elevated privileges (with the privileges of the Apache webserver process). Failed exploit attempts may crash the affected application, denying service to legitimate users. Note: To trigger this issue, 'mod_setenvif' must be enabled and the attacker should be able to place a malicious '.htaccess' file on the affected webserver. The could allow the attacker to access internal servers that are not otherwise accessible from the outside. The three CVE ids denote slightly different variants of the same issue. Note that, even with this issue fixed, it is the responsibility of the administrator to ensure that the regular expression replacement pattern for the target URI does not allow a client to append arbitrary strings to the host or port parts of the target URI. This is a violation of the privilege separation between the apache2 processes and could potentially be used to worsen the impact of other vulnerabilities. CVE-2012-0053: The response message for error code 400 (bad request) could be used to expose "httpOnly" cookies. This could allow a remote attacker using cross site scripting to steal authentication cookies. For the oldstable distribution (lenny), these problems have been fixed in version apache2 2.2.9-10+lenny12. For the stable distribution (squeeze), these problems have been fixed in version apache2 2.2.16-6+squeeze6 For the testing distribution (wheezy), these problems will be fixed in version 2.2.22-1. For the unstable distribution (sid), these problems have been fixed in version 2.2.22-1. We recommend that you upgrade your apache2 packages. The new version number for the oldstable distribution is 2.2.6-02-1+lenny7. In the stable distribution, apache2-mpm-itk has the same version number as apache2. HP System Management Homepage (SMH) before v7.1.1 running on Linux, Windows and VMware ESX. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. (CVE-2011-3368) It was discovered that mod_proxy_ajp incorrectly returned an "Internal Server Error" response when processing certain malformed HTTP requests, which caused the back-end server to be marked as failed in configurations where mod_proxy was used in load balancer mode. A remote attacker could cause mod_proxy to not send requests to back-end AJP (Apache JServ Protocol) servers for the retry timeout period or until all back-end servers were marked as failed. (CVE-2011-3607) A NULL pointer dereference flaw was found in the httpd mod_log_config module. This update also fixes the following bug: * The fix for CVE-2011-3192 provided by the RHSA-2011:1330 update introduced a regression in the way httpd handled certain Range HTTP header values. This update corrects this regression. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). Release Date: 2012-04-18 Last Updated: 2012-04-18 Potential Security Impact: Remote Denial of Service (DoS), local increase of privilege Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Running Apache. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS) or to gain a local increase of privilege. References: CVE-2011-3607, CVE-2012-0021, CVE-2012-0031, CVE-2012-0053 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.22 or earlier HP-UX B.11.11 running HP-UX Apache Web Server Suite v2.34 or earlier BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2011-3607 (AV:L/AC:M/Au:N/C:P/I:P/A:P) 4.4 CVE-2012-0021 (AV:N/AC:H/Au:N/C:N/I:N/A:P) 2.6 CVE-2012-0031 (AV:L/AC:L/Au:N/C:P/I:P/A:P) 4.6 CVE-2012-0053 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following software updates to resolve the vulnerability. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.23 HP-UX B.11.31 ================== hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 action: install revision B.2.2.15.12 or subsequent HP-UX B.11.11 ================== hpuxwsAPACHE.APACHE hpuxwsAPACHE.APACHE2 hpuxwsAPACHE.AUTH_LDAP hpuxwsAPACHE.AUTH_LDAP2 hpuxwsAPACHE.MOD_JK hpuxwsAPACHE.MOD_JK2 hpuxwsAPACHE.MOD_PERL hpuxwsAPACHE.MOD_PERL2 hpuxwsAPACHE.PHP hpuxwsAPACHE.PHP2 hpuxwsAPACHE.WEBPROXY action: install revision B.2.0.64.03 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 18 April 2012 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. HP Secure Web Server (SWS) for OpenVMS V2.2 and earlier. ============================================================================ Ubuntu Security Notice USN-1368-1 February 16, 2012 apache2 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: Several security issues were fixed in the Apache HTTP Server. An attacker having write access to a .htaccess file may exploit this to possibly execute arbitrary code. (CVE-2011-3607) Prutha Parikh discovered that the mod_proxy module did not properly interact with the RewriteRule and ProxyPassMatch pattern matches in the configuration of a reverse proxy. (CVE-2011-4317) Rainer Canavan discovered that the mod_log_config module incorrectly handled a certain format string when used with a threaded MPM. This issue only affected Ubuntu 11.04 and 11.10. (CVE-2012-0053) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: apache2.2-common 2.2.20-1ubuntu1.2 Ubuntu 11.04: apache2.2-common 2.2.17-1ubuntu1.5 Ubuntu 10.10: apache2.2-common 2.2.16-1ubuntu3.5 Ubuntu 10.04 LTS: apache2.2-common 2.2.14-5ubuntu8.8 Ubuntu 8.04 LTS: apache2.2-common 2.2.8-1ubuntu0.23 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: httpd security update Advisory ID: RHSA-2012:0323-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0323.html Issue date: 2012-02-21 CVE Names: CVE-2011-3607 CVE-2011-3639 CVE-2012-0031 CVE-2012-0053 ===================================================================== 1. Summary: Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1392) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request. (CVE-2011-3639) The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies. (CVE-2012-0053) An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions. An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a ".htaccess" file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the "apache" user. (CVE-2011-3607) A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown. (CVE-2012-0031) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 752080 - CVE-2011-3639 httpd: http 0.9 request bypass of the reverse proxy vulnerability CVE-2011-3368 fix 769844 - CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow 773744 - CVE-2012-0031 httpd: possible crash on shutdown due to flaw in scoreboard handling 785069 - CVE-2012-0053 httpd: cookie exposure due to error responses 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm i386: httpd-2.2.3-63.el5_8.1.i386.rpm httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm mod_ssl-2.2.3-63.el5_8.1.i386.rpm x86_64: httpd-2.2.3-63.el5_8.1.x86_64.rpm httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm mod_ssl-2.2.3-63.el5_8.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm i386: httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm httpd-devel-2.2.3-63.el5_8.1.i386.rpm httpd-manual-2.2.3-63.el5_8.1.i386.rpm x86_64: httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm httpd-devel-2.2.3-63.el5_8.1.i386.rpm httpd-devel-2.2.3-63.el5_8.1.x86_64.rpm httpd-manual-2.2.3-63.el5_8.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm i386: httpd-2.2.3-63.el5_8.1.i386.rpm httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm httpd-devel-2.2.3-63.el5_8.1.i386.rpm httpd-manual-2.2.3-63.el5_8.1.i386.rpm mod_ssl-2.2.3-63.el5_8.1.i386.rpm ia64: httpd-2.2.3-63.el5_8.1.ia64.rpm httpd-debuginfo-2.2.3-63.el5_8.1.ia64.rpm httpd-devel-2.2.3-63.el5_8.1.ia64.rpm httpd-manual-2.2.3-63.el5_8.1.ia64.rpm mod_ssl-2.2.3-63.el5_8.1.ia64.rpm ppc: httpd-2.2.3-63.el5_8.1.ppc.rpm httpd-debuginfo-2.2.3-63.el5_8.1.ppc.rpm httpd-debuginfo-2.2.3-63.el5_8.1.ppc64.rpm httpd-devel-2.2.3-63.el5_8.1.ppc.rpm httpd-devel-2.2.3-63.el5_8.1.ppc64.rpm httpd-manual-2.2.3-63.el5_8.1.ppc.rpm mod_ssl-2.2.3-63.el5_8.1.ppc.rpm s390x: httpd-2.2.3-63.el5_8.1.s390x.rpm httpd-debuginfo-2.2.3-63.el5_8.1.s390.rpm httpd-debuginfo-2.2.3-63.el5_8.1.s390x.rpm httpd-devel-2.2.3-63.el5_8.1.s390.rpm httpd-devel-2.2.3-63.el5_8.1.s390x.rpm httpd-manual-2.2.3-63.el5_8.1.s390x.rpm mod_ssl-2.2.3-63.el5_8.1.s390x.rpm x86_64: httpd-2.2.3-63.el5_8.1.x86_64.rpm httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm httpd-devel-2.2.3-63.el5_8.1.i386.rpm httpd-devel-2.2.3-63.el5_8.1.x86_64.rpm httpd-manual-2.2.3-63.el5_8.1.x86_64.rpm mod_ssl-2.2.3-63.el5_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-3607.html https://www.redhat.com/security/data/cve/CVE-2011-3639.html https://www.redhat.com/security/data/cve/CVE-2012-0031.html https://www.redhat.com/security/data/cve/CVE-2012-0053.html https://access.redhat.com/security/updates/classification/#moderate https://rhn.redhat.com/errata/RHSA-2011-1392.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFPRBwPXlSAg2UNWIIRAlvJAJ0TMniw4hLPlG+CAhF6cZd3RqTH3QCfVlvK 6HtbvIeYuOnRkg4sqECy22U= =UZwj -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.89

sources: NVD: CVE-2011-3607 // BID: 50494 // VULMON: CVE-2011-3607 // PACKETSTORM: 109464 // PACKETSTORM: 121573 // PACKETSTORM: 112503 // PACKETSTORM: 112059 // PACKETSTORM: 117251 // PACKETSTORM: 109837 // PACKETSTORM: 110036

AFFECTED PRODUCTS

vendor:apachemodel:http serverscope:eqversion:2.0.9

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.28

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.35

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.34

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.32

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.37

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.36

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.0.43

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.6

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.4

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.11

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.19

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.41

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.42

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.58

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.44

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.55

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.8

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.12

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.13

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.54

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.40

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.64

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.45

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.18

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.47

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.52

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.48

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.57

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.59

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.16

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.53

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.63

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.46

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.3

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.9

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.15

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.51

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.21

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.1

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.10

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.20

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.60

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.49

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.50

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.2

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.0

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.14

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.61

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.39

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.56

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.0.38

Trust: 1.0

vendor:ubuntumodel:linux i386scope:eqversion:11.10

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.2

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j editionscope:eqversion:8.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.18

Trust: 0.3

vendor:avayamodel:aura session manager sp2scope:eqversion:6.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.1

Trust: 0.3

vendor:fujitsumodel:interstage studio enterprise editionscope:eqversion:8.0.1

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:9.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2

Trust: 0.3

vendor:fujitsumodel:interstage application server plusscope:eqversion:6.0.2

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:5.0.1

Trust: 0.3

vendor:slackwaremodel:linux x86 64scope:eqversion:13.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.23scope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.58

Trust: 0.3

vendor:apachemodel:software foundation apache -betascope:eqversion:2.0.32

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.54

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage apworks modelers-j editionscope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise edition l11scope:eqversion:5.0

Trust: 0.3

vendor:apachemodel:software foundation apache betascope:eqversion:2.0.28

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:12.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.42

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.11

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6.2

Trust: 0.3

vendor:avayamodel:voice portal sp1scope:eqversion:5.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.28

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.38

Trust: 0.3

vendor:fujitsumodel:interstage application server plusscope:eqversion:7.0.1

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1

Trust: 0.3

vendor:fujitsumodel:interstage application server plus developerscope:eqversion:7.0

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.52

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.63

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.8

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.36

Trust: 0.3

vendor:fujitsumodel:interstage studio standard-j editionscope:eqversion:9.2

Trust: 0.3

vendor:fujitsumodel:interstage application server plusscope:eqversion:6.0.1

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j editionscope:eqversion:9.0

Trust: 0.3

vendor:redmodel:hat jboss enterprise web server for rhelscope:eqversion:61.0

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.3

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:12.2

Trust: 0.3

vendor:mandrakesoftmodel:enterprise serverscope:eqversion:5

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.41

Trust: 0.3

vendor:fujitsumodel:interstage studio standard-j editionscope:eqversion:9.0

Trust: 0.3

vendor:avayamodel:voice portal sp2scope:eqversion:5.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.8

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.9

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.15

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.57

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.0.19

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.11

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.10

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.0

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.0.15

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:6.1.1

Trust: 0.3

vendor:fujitsumodel:interstage studio enterprise editionscope:eqversion:9.0

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:8.04

Trust: 0.3

vendor:mandrivamodel:linux mandrake x86 64scope:eqversion:2011

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.9

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.10

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:8.0.3

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.59

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:8.0.2

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:9.0.1

Trust: 0.3

vendor:ubuntumodel:linux lts powerpcscope:eqversion:8.04

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.49

Trust: 0.3

vendor:fujitsumodel:interstage application server plusscope:eqversion:5.0.1

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.0.1

Trust: 0.3

vendor:redmodel:hat enterprise linux desktop clientscope:eqversion:5

Trust: 0.3

vendor:fujitsumodel:interstage application server plus developerscope:eqversion:5.0.1

Trust: 0.3

vendor:slackwaremodel:linux x86 64scope:eqversion:13.37

Trust: 0.3

vendor:avayamodel:aura session manager sp1scope:eqversion:6.1

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:1.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.50

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:5.0

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.04

Trust: 0.3

vendor:redmodel:hat enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.10

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.6

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j editionscope:eqversion:9.0.1

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1.1

Trust: 0.3

vendor:apachemodel:software foundation apache -betascope:eqversion:2.0.34

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:avayamodel:aura communication managerscope:eqversion:6.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.8

Trust: 0.3

vendor:ubuntumodel:linux lts sparcscope:eqversion:8.04

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.5

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.16

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.4

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.10

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:8.04

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.64

Trust: 0.3

vendor:fujitsumodel:interstage application server standard editionscope:eqversion:5.0

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:6.0

Trust: 0.3

vendor:redmodel:hat enterprise linux hpc node optionalscope:eqversion:6

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:9.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.60

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.0.5

Trust: 0.3

vendor:slackwaremodel:linux -currentscope: - version: -

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:11.04

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.51

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.4

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.12

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:13.1

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.0.17

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:6.1

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.2

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.10

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:6.1.1

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j edition 9.1.0bscope: - version: -

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:12.1

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:13.37

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.2

Trust: 0.3

vendor:apachemodel:software foundation apache -betascope:eqversion:2.0.28

Trust: 0.3

vendor:avayamodel:aura session manager sp1scope:eqversion:5.2

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:13.0

Trust: 0.3

vendor:xeroxmodel:freeflow print server 73.b3.61scope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.53

Trust: 0.3

vendor:redmodel:hat jboss enterprise web server for rhel serverscope:eqversion:51.0

Trust: 0.3

vendor:fujitsumodel:interstage apworks modelers-j editionscope:eqversion:7.0

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.10

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.35

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.1

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.0

Trust: 0.3

vendor:mandrivamodel:linux mandrake x86 64scope:eqversion:2010.1

Trust: 0.3

vendor:avayamodel:voice portal sp1scope:eqversion:5.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.55

Trust: 0.3

vendor:redmodel:hat enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1.2

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:7.0

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.7

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise edition l10bscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage application server plusscope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura communication managerscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.2

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.56

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop workstation clientscope:eqversion:5

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.37

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.0

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:5.2

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:8.0

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.2

Trust: 0.3

vendor:mandrivamodel:linux mandrakescope:eqversion:2011

Trust: 0.3

vendor:fujitsumodel:interstage application server plus developerscope:eqversion:6.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.39

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:6.0.1

Trust: 0.3

vendor:ubuntumodel:linux lts lpiascope:eqversion:8.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:11.04

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.32

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.21

Trust: 0.3

vendor:ibmmodel:http serverscope:eqversion:7.0.0.13

Trust: 0.3

vendor:hpmodel:openvms secure web serverscope:eqversion:2.2

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise edition l10scope:eqversion:5.0

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:1.0

Trust: 0.3

vendor:ibmmodel:http serverscope:neversion:7.0.0.21

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:11.04

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage business application server enterprise editionscope:eqversion:8.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.5

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:9.2

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11scope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:neversion:2.2.22

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:6.1.2

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.3

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.48

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.45

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage studio standard-j editionscope:eqversion:9.1

Trust: 0.3

vendor:hpmodel:hp-ux b.11.31scope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.43

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.47

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura experience portalscope:eqversion:6.0

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:6.0.2

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.2

Trust: 0.3

vendor:fujitsumodel:interstage studio enterprise editionscope:eqversion:9.1

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j editionscope:eqversion:9.2

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:7.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.46

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.2

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:6.0

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:7.0.1

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.3

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.44

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.3

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise editionscope:eqversion:8.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.40

Trust: 0.3

vendor:avayamodel:aura session manager sp1scope:eqversion:6.0

Trust: 0.3

vendor:redmodel:hat enterprise linux desktop optionalscope:eqversion:6

Trust: 0.3

vendor:mandrakesoftmodel:enterprise server x86 64scope:eqversion:5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.3

Trust: 0.3

vendor:redmodel:hat enterprise linux desktopscope:eqversion:6

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:6.1.3

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.1

Trust: 0.3

vendor:avayamodel:aura session manager sp2scope:eqversion:5.2

Trust: 0.3

vendor:fujitsumodel:interstage application server enterprise edition l10ascope:eqversion:5.0

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.14

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.0.61

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.3

Trust: 0.3

vendor:fujitsumodel:interstage application server standard-j editionscope:eqversion:8.0.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.9

Trust: 0.3

vendor:xeroxmodel:freeflow print server 73.c0.41scope: - version: -

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.4

Trust: 0.3

vendor:fujitsumodel:interstage studio standard-j editionscope:eqversion:8.0.1

Trust: 0.3

vendor:fujitsumodel:interstage studio standard-j edition bscope:eqversion:9.1.0

Trust: 0.3

vendor:slackwaremodel:linux x86 64scope:eqversion:13.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.1

Trust: 0.3

vendor:slackwaremodel:linux x86 64 -currentscope: - version: -

Trust: 0.3

vendor:mandrivamodel:linux mandrakescope:eqversion:2010.1

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.1.6

Trust: 0.3

vendor:apachemodel:software foundation apachescope:eqversion:2.2.13

Trust: 0.3

sources: BID: 50494 // CNNVD: CNNVD-201111-112 // NVD: CVE-2011-3607

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-3607
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-201111-112
value: MEDIUM

Trust: 0.6

VULMON: CVE-2011-3607
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-3607
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

sources: VULMON: CVE-2011-3607 // CNNVD: CNNVD-201111-112 // NVD: CVE-2011-3607

PROBLEMTYPE DATA

problemtype:CWE-189

Trust: 1.0

sources: NVD: CVE-2011-3607

THREAT TYPE

local

Trust: 1.0

sources: BID: 50494 // PACKETSTORM: 112059 // CNNVD: CNNVD-201111-112

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-201111-112

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2011-3607

PATCH

title:Red Hat: Moderate: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120323 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: httpd security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120542 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120128 - Security Advisory

Trust: 0.1

title:Ubuntu Security Notice: apache2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-1368-1

Trust: 0.1

title:Amazon Linux AMI: ALAS-2012-046url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2012-046

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - January 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=4a692d6d60aa31507cb101702b494c51

Trust: 0.1

title:ReconScanurl:https://github.com/RoliSoft/ReconScan

Trust: 0.1

title:ReconScanurl:https://github.com/GiJ03/ReconScan

Trust: 0.1

title:testurl:https://github.com/issdp/test

Trust: 0.1

title:ReconScanurl:https://github.com/kira1111/ReconScan

Trust: 0.1

title:pigaturl:https://github.com/teamssix/pigat

Trust: 0.1

sources: VULMON: CVE-2011-3607

EXTERNAL IDS

db:NVDid:CVE-2011-3607

Trust: 2.7

db:BIDid:50494

Trust: 1.9

db:SECUNIAid:48551

Trust: 1.6

db:SECUNIAid:45793

Trust: 1.6

db:SECTRACKid:1026267

Trust: 1.6

db:OSVDBid:76744

Trust: 1.6

db:CNNVDid:CNNVD-201111-112

Trust: 0.6

db:VULMONid:CVE-2011-3607

Trust: 0.1

db:PACKETSTORMid:109464

Trust: 0.1

db:PACKETSTORMid:121573

Trust: 0.1

db:PACKETSTORMid:112503

Trust: 0.1

db:PACKETSTORMid:112059

Trust: 0.1

db:PACKETSTORMid:117251

Trust: 0.1

db:PACKETSTORMid:109837

Trust: 0.1

db:PACKETSTORMid:110036

Trust: 0.1

sources: VULMON: CVE-2011-3607 // BID: 50494 // PACKETSTORM: 109464 // PACKETSTORM: 121573 // PACKETSTORM: 112503 // PACKETSTORM: 112059 // PACKETSTORM: 117251 // PACKETSTORM: 109837 // PACKETSTORM: 110036 // CNNVD: CNNVD-201111-112 // NVD: CVE-2011-3607

REFERENCES

url:http://www.halfdog.net/security/2011/apachemodsetenvifintegeroverflow/demoexploit.html

Trust: 1.9

url:http://rhn.redhat.com/errata/rhsa-2012-0543.html

Trust: 1.7

url:http://www.mandriva.com/security/advisories?name=mdvsa-2012:003

Trust: 1.6

url:http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html

Trust: 1.6

url:http://www.osvdb.org/76744

Trust: 1.6

url:http://lists.apple.com/archives/security-announce/2012/sep/msg00004.html

Trust: 1.6

url:https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422

Trust: 1.6

url:http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Trust: 1.6

url:http://marc.info/?l=bugtraq&m=133494237717847&w=2

Trust: 1.6

url:http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html

Trust: 1.6

url:http://support.apple.com/kb/ht5501

Trust: 1.6

url:https://bugzilla.redhat.com/show_bug.cgi?id=750935

Trust: 1.6

url:http://marc.info/?l=bugtraq&m=133294460209056&w=2

Trust: 1.6

url:http://rhn.redhat.com/errata/rhsa-2012-0128.html

Trust: 1.6

url:http://securitytracker.com/id?1026267

Trust: 1.6

url:http://marc.info/?l=bugtraq&m=134987041210674&w=2

Trust: 1.6

url:http://secunia.com/advisories/48551

Trust: 1.6

url:http://rhn.redhat.com/errata/rhsa-2012-0542.html

Trust: 1.6

url:http://www.debian.org/security/2012/dsa-2405

Trust: 1.6

url:http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Trust: 1.6

url:http://www.mandriva.com/security/advisories?name=mdvsa-2013:150

Trust: 1.6

url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041

Trust: 1.6

url:http://www.securityfocus.com/bid/50494

Trust: 1.6

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/71093

Trust: 1.6

url:http://secunia.com/advisories/45793

Trust: 1.6

url:http://www.halfdog.net/security/2011/apachemodsetenvifintegeroverflow/

Trust: 1.3

url:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2012-0031

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2011-3607

Trust: 0.7

url:http://support.avaya.com/css/p8/documents/100158872

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2012-0053

Trust: 0.6

url:httpd.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.

Trust: 0.6

url:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs.

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2011-4317

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2012-0021

Trust: 0.4

url:http://httpd.apache.org/

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg27014506

Trust: 0.3

url:https://h20565.www2.hp.com/portal/site/hpsc/template.page/public/kb/docdisplay/?javax.portlet.tpst=ba847bafb2a2d782fcbb0710b053ce01&javax.portlet.prp_ba847bafb2a2d782fcbb0710b053ce01=wsrp-navigational

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg1pm50426

Trust: 0.3

url:https://support.avaya.com/css/p8/documents/100155944

Trust: 0.3

url:http://support.avaya.com/css/p8/documents/100157326

Trust: 0.3

url:http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c03231301&ac.admitted=1332965374461.876444892.492883150

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2011-3368

Trust: 0.3

url:http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/

Trust: 0.3

url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2011-3639

Trust: 0.2

url:https://h20566.www2.hp.com/portal/site/hpsc/public/kb/

Trust: 0.2

url:https://www.redhat.com/security/data/cve/cve-2011-3607.html

Trust: 0.2

url:https://www.redhat.com/security/data/cve/cve-2012-0031.html

Trust: 0.2

url:https://access.redhat.com/security/team/contact/

Trust: 0.2

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.2

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.2

url:https://www.redhat.com/security/data/cve/cve-2012-0053.html

Trust: 0.2

url:http://bugzilla.redhat.com/):

Trust: 0.2

url:http://internal-host/$1

Trust: 0.1

url:http://internal-host$1

Trust: 0.1

url:http://www.debian.org/security/faq

Trust: 0.1

url:http://www.debian.org/security/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0036

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2016

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0057

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4078

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-1165

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4885

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-2834

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-1944

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2014

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0830

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4108

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4153

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-1823

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2013

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4415

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4577

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4619

Trust: 0.1

url:http://www.hp.com/swpublishing/mtx-ac3d1f80b8dd48b792bfc01a08

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0027

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2012

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2015

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3379

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4576

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-2821

Trust: 0.1

url:https://www.redhat.com/security/data/cve/cve-2011-3368.html

Trust: 0.1

url:https://rhn.redhat.com/errata/rhsa-2011-1330.html

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=webserver&downloadtype=securitypatches&version=1.0.2

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3348

Trust: 0.1

url:https://www.redhat.com/security/data/cve/cve-2011-3348.html

Trust: 0.1

url:https://www.redhat.com/security/data/cve/cve-2012-0021.html

Trust: 0.1

url:https://h20392.www2.hp.com/portal/swdepot/try.do?productnumber=hpuxwsatw235

Trust: 0.1

url:https://h20392.www2.hp.com/portal/swdepot/displayproductinfo.do?productnumber=hpuxwsatw323

Trust: 0.1

url:https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c02964430

Trust: 0.1

url:https://www.hp.com/go/swa

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-0419

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-1928

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3192

Trust: 0.1

url:http://h71000.www7.hp.com/openvms/products/ips/apache/csws_patches.html

Trust: 0.1

url:http://www.ubuntu.com/usn/usn-1368-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/apache2/2.2.20-1ubuntu1.2

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/apache2/2.2.16-1ubuntu3.5

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/apache2/2.2.8-1ubuntu0.23

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/apache2/2.2.17-1ubuntu1.5

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/apache2/2.2.14-5ubuntu8.8

Trust: 0.1

url:https://rhn.redhat.com/errata/rhsa-2012-0323.html

Trust: 0.1

url:https://access.redhat.com/kb/docs/doc-11259

Trust: 0.1

url:https://rhn.redhat.com/errata/rhsa-2011-1392.html

Trust: 0.1

url:https://access.redhat.com/security/team/key/#package

Trust: 0.1

url:https://www.redhat.com/security/data/cve/cve-2011-3639.html

Trust: 0.1

sources: BID: 50494 // PACKETSTORM: 109464 // PACKETSTORM: 121573 // PACKETSTORM: 112503 // PACKETSTORM: 112059 // PACKETSTORM: 117251 // PACKETSTORM: 109837 // PACKETSTORM: 110036 // CNNVD: CNNVD-201111-112 // NVD: CVE-2011-3607

CREDITS

halfdog

Trust: 0.3

sources: BID: 50494

SOURCES

db:VULMONid:CVE-2011-3607
db:BIDid:50494
db:PACKETSTORMid:109464
db:PACKETSTORMid:121573
db:PACKETSTORMid:112503
db:PACKETSTORMid:112059
db:PACKETSTORMid:117251
db:PACKETSTORMid:109837
db:PACKETSTORMid:110036
db:CNNVDid:CNNVD-201111-112
db:NVDid:CVE-2011-3607

LAST UPDATE DATE

2025-09-14T20:10:53.125000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2011-3607date:2021-06-06T00:00:00
db:BIDid:50494date:2015-04-13T20:49:00
db:CNNVDid:CNNVD-201111-112date:2021-06-07T00:00:00
db:NVDid:CVE-2011-3607date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:VULMONid:CVE-2011-3607date:2011-11-08T00:00:00
db:BIDid:50494date:2011-11-02T00:00:00
db:PACKETSTORMid:109464date:2012-02-07T00:10:33
db:PACKETSTORMid:121573date:2013-05-09T14:44:00
db:PACKETSTORMid:112503date:2012-05-07T20:02:40
db:PACKETSTORMid:112059date:2012-04-21T00:19:01
db:PACKETSTORMid:117251date:2012-10-10T02:28:54
db:PACKETSTORMid:109837date:2012-02-17T02:34:31
db:PACKETSTORMid:110036date:2012-02-22T02:10:49
db:CNNVDid:CNNVD-201111-112date:2011-11-04T00:00:00
db:NVDid:CVE-2011-3607date:2011-11-08T11:55:05.693