CVE-2009-2699

CWE-6676 documents6 sources
Severity
7.5HIGH
EPSS
8.7%
top 7.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Http ServerApache Portable Runtime
Timeline
PublishedOct 13
Latest updateMay 2

Description

The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/http_server2.2.0 — 2.2.14

Patches

Patch: www.securityfocus.com ↗Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-2vjp-v45q-4g2x: The Solaris pollset feature in the Event Port backend in poll/unix/port↗2022-05-02
▶
CVEList
CVE-2009-2699: The Solaris pollset feature in the Event Port backend in poll/unix/port↗2009-10-13
▶

📋Vendor Advisories

2
Red Hat
(apr): Improper pollset feature error handling on Solaris - DoS (hang)↗2009-10-05
▶
Debian
CVE-2009-2699: apr - The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-2699 httpd (apr): Improper pollset feature error handling on Solaris - DoS (hang)↗2009-10-13
▶
CVE-2009-2699 (HIGH CVSS 7.5) | The Solaris pollset feature in the | cvebase.io