Oval Definition:oval:org.mitre.oval:def:11094
Revision Date:2013-04-29Version:12
Title:The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Description:The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Family:unixClass:vulnerability
Status:ACCEPTEDReference(s):CVE-2009-1195
Platform(s):CentOS Linux 5
Oracle Linux 5
Red Hat Enterprise Linux 5
Product(s):
Definition Synopsis
  • RHEL5, CentOS5 or Oracle Linux 5
  • The operating system installed on the system is Red Hat Enterprise Linux 5
  • OR The operating system installed on the system is CentOS Linux 5.x
  • OR Oracle Linux 5.x
  • AND Configuration section
  • httpd-manual is earlier than 0:2.2.3-22.el5_3.1
  • OR httpd-devel is earlier than 0:2.2.3-22.el5_3.1
  • OR mod_ssl is earlier than 0:2.2.3-22.el5_3.1
  • OR httpd is earlier than 0:2.2.3-22.el5_3.1
    • BACK