CVE-2009-3095: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 13.5% chance of exploitation in the next 30 days.

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.64 (fixed in 2.0.64); from 2.2.0, before 2.2.14 (fixed in 2.2.14)
• Apple Mac OS X: before 10.6.3 (fixed in 10.6.3)
• Debian Debian Linux: version 4.0 only
• Fedoraproject Fedora: version 10 only; version 12 only
• Opensuse Opensuse: version 10.3 only; version 11.0 only; version 11.1 only
• Suse Linux Enterprise Desktop: version 10 only
• Suse Linux Enterprise Server: version 9 only; version 10 only; version 11 only

Published 2009-09-08. Last modified 2026-06-16.