Ask the Community
Groups
CVE-2009-1955: Apache httpd: APR-util XML DoS - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2009-1955</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p>A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language (XML) parser. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine.<br><br>Severity: moderate<br><br>Unitrends could be vulnerable to this, but it requires a great deal of expertise to craft the exploit. It would also require network access to the Unitrends system. No data would be affected, but it could slow down the system.</p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p>The CentOS6.5 distribution already contains the fix.<br><br>Resolved in: </p> <ul><li>For CentOS6, the distribution already contains this fix.</li> <li>For CentOS5, apr-util-1.2.7-11.el5_5.2 or later has this fix, and Unitrends appliances should already have apr-util-1.2.7-7.el5_3.2.</li> <li>Upstream Apache httpd 2.2.12</li> </ul><h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fcve%2FCVE-2009-1955%250D%250Ahttp%3A%2F%2Fhttpd.apache.org%2Fsecurity%2Fvulnerabilities_22.html">https://access.redhat.com/security/cve/CVE-2009-1955 http://httpd.apache.org/security/vulnerabilities_22.html</a></li></ul> </article> </main>