CVE-2010-0425
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 94.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 94.25% probability · 100th percentile
- CISA KEV
- Not listed
- Affected
- ibm/websphere application server · apache/http server · ibm/http server · oracle/http server · broadcom/vmware ace management server
- Source
- secalert@redhat.com
References
- http://httpd.apache.org/security/vulnerabilities_20.htmlVendor Advisory
- http://httpd.apache.org/security/vulnerabilities_22.htmlVendor Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000105.htmlBroken Link
- http://secunia.com/advisories/38978Broken Link
- http://secunia.com/advisories/39628Broken Link
- http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870Permissions Required
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870Permissions Required
- http://svn.apache.org/viewvc?view=revision&revision=917870Permissions Required
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247Third Party Advisory
- http://www.kb.cert.org/vuls/id/280613Third Party Advisory, US Government Resource
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlThird Party Advisory
- http://www.securityfocus.com/bid/38494Broken Link, Exploit
- http://www.securitytracker.com/id?1023701Broken Link
- http://www.senseofsecurity.com.au/advisories/SOS-10-002Third Party Advisory, URL Repurposed
- http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlThird Party Advisory
- http://www.vupen.com/english/advisories/2010/0634Broken Link, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0994Broken Link, Issue Tracking, Mailing List, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56624Third Party Advisory
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3EIssue Tracking, Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.