CVE-2010-0425
Critical
Description
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
SeverityCritical
CVSS10.0
Exploit probability—
Product
Apache Http Server
PublishedMar 5, 2010
First seenMar 5, 2010
How to fix
Update
- apache http_server2.0.64, 2.2.15, 2.3.7 or later
- ibm websphere_application_server6.1.0.31 or later
- broadcom vmware_ace_management_server2.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.0.37 ≤ v < 2.0.64, 2.2.0 ≤ v < 2.2.15, 2.3.0 ≤ v < 2.3.7 | 2.0.64, 2.2.15, 2.3.7 |
| ibm websphere_application_server | 6.1 ≤ v < 6.1.0.31 | 6.1.0.31 |
| ibm http_server | 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.7, 6.0.2.9, 6.0.2.11, 6.0.2.13, 6.0.2.15, 6.0.2.19, 6.0.2.21, 6.0.2.23, 6.0.2.25, 6.0.2.27, 6.0.2.29, 6.0.2.31, 6.0.2.33, 6.0.2.35, 6.0.2.37, 6.0.2.39, 6.1, 6.1.0.2, 6.1.0.3, 6.1.0.5, 6.1.0.7, 6.1.0.9, 6.1.0.11, 6.1.0.13, 6.1.0.15, 6.1.0.17, 6.1.0.19, 6.1.0.21, 6.1.0.23, 6.1.0.25, 6.1.0.27, 6.1.0.29 | — |
| oracle http_server | 10.1.3.5.0 | — |
| broadcom vmware_ace_management_server | v < 2.7.2 | 2.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.