NVD Vulnerability Detail
Search Exploit, PoC
CVE-2008-2384
Summary

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.

Summary

Please note that this describes the software used in debian as mod-auth-mysql (binary name is libapache2-mod-auth-mysql). It is different from the Sourceforge project.

Publication Date Jan. 23, 2009, 3:30 a.m.
Registration Date Jan. 29, 2021, 1:36 p.m.
Last Update Oct. 31, 2018, 1:25 a.m.
CVSS2.0 : HIGH
Score 7.5
Vector AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC) 低
攻撃前の認証要否(Au) 不要
機密性への影響(C) 低
完全性への影響(I) 低
可用性への影響(A) 低
Get all privileges. いいえ
Get user privileges いいえ
Get other privileges はい
User operation required いいえ
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:joey_schulze:mod_auth_mysql:*:*:*:*:*:*:*:*
execution environment
1 cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*
2 cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
3 cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
4 cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
5 cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
6 cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:*
7 cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
8 cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*
9 cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:*
10 cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*
11 cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:*
12 cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
13 cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
14 cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
15 cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
16 cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
17 cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
18 cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
19 cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
20 cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
21 cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
22 cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
23 cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
24 cpe:2.3:a:apache:http_server:2.0.46:*:win32:*:*:*:*:*
25 cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
26 cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*
27 cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*
28 cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*
29 cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*
30 cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*
31 cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*
32 cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*
33 cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*
34 cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*
35 cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*
36 cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*
37 cpe:2.3:a:apache:http_server:2.0.58:*:win32:*:*:*:*:*
38 cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*
39 cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*
40 cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*
41 cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:*
42 cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:*
43 cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:*
44 cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:*
45 cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:*
46 cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:*
47 cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:*
48 cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:*
49 cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:*
50 cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*
51 cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*
52 cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*
53 cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*
54 cpe:2.3:a:apache:http_server:2.2.2:*:windows:*:*:*:*:*
55 cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*
56 cpe:2.3:a:apache:http_server:2.2.3:*:windows:*:*:*:*:*
57 cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*
58 cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*
59 cpe:2.3:a:apache:http_server:2.3.0:*:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List
JVN Vulnerability Information
Apache HTTP Server の mod-auth-mysql モジュールにおける SQL インジェクションの脆弱性
Title Apache HTTP Server の mod-auth-mysql モジュールにおける SQL インジェクションの脆弱性
Summary

Apache HTTP Server の mod-auth-mysql モジュールには、マルチバイト文字のエンコード処理に不備があるため、SQL インジェクションの脆弱性が存在します。

Possible impacts リモートの攻撃者により、任意の SQL コマンドを実行される可能性があります。
Solution

ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date Jan. 22, 2009, midnight
Registration Date March 9, 2009, 12:09 p.m.
Last Update Jan. 12, 2011, 3:03 p.m.
Affected System
レッドハット
Red Hat Enterprise Linux 5 (server)
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6
RHEL Desktop Workstation 5 (client)
Apache Software Foundation
Apache HTTP Server 2.x
サイバートラスト株式会社
Asianux Server 3 (x86)
Asianux Server 3 (x86-64)
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
No Changed Details Date of change
0 [2009年03月09日]
  掲載
[2009年04月09日]
  影響を受けるシステム：ミラクル・リナックス (mod_auth_mysql-3.0.0-3.2AXS3) の情報を追加
  ベンダ情報：ミラクル・リナックス (mod_auth_mysql-3.0.0-3.2AXS3) を追加
[2011年01月12日]
  影響を受けるシステム：レッドハット (RHSA-2010:1002) の情報を追加
  ベンダ情報：レッドハット (RHSA-2010:1002) を追加		 Feb. 17, 2018, 10:37 a.m.