Details of VAR-201001-0064

ID

VAR-201001-0064

CVE

CVE-2009-4587

TITLE

Cherokee Web Server GET request Denial of Service Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2010-5509 // CNNVD: CNNVD-201001-045

DESCRIPTION

Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service (daemon crash) via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word. Cherokee Web Server is a flexible, fast, lightweight web server. An attacker could exploit this issue to crash the affected application, denying service to legitimate users. Cherokee Web Server 0.5.4 is vulnerable; other versions may also be affected NOTE: This BID is being retired because the vulnerability is caused by a problem in Microsoft Windows when handling DOS-style device names; it is not specific to this application

Trust: 2.7

sources: NVD: CVE-2009-4587 // JVNDB: JVNDB-2010-003643 // CNVD: CNVD-2010-5509 // BID: 36814 // BID: 79183

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2010-5509

AFFECTED PRODUCTS

vendor:	cherokee	model:	cherokee	scope:	eq	version:	0.5.4	Trust: 3.3
vendor:	cherokee	model:	httpd	scope:	eq	version:	0.5.4	Trust: 0.3

sources: CNVD: CNVD-2010-5509 // BID: 36814 // BID: 79183 // JVNDB: JVNDB-2010-003643 // CNNVD: CNNVD-201001-045 // NVD: CVE-2009-4587

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-4587
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2009-4587
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2010-5509
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201001-045
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2009-4587
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2010-5509
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2010-5509 // JVNDB: JVNDB-2010-003643 // CNNVD: CNNVD-201001-045 // NVD: CVE-2009-4587

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2010-003643 // NVD: CVE-2009-4587

THREAT TYPE

network

Trust: 0.6

sources: BID: 36814 // BID: 79183

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201001-045

CONFIGURATIONS

sources: JVNDB: JVNDB-2010-003643

PATCH

title:

Top Page

url:

http://www.cherokee-project.com/

Trust: 0.8

sources: JVNDB: JVNDB-2010-003643

EXTERNAL IDS

db:	NVD	id:	CVE-2009-4587	Trust: 3.3
db:	BID	id:	36814	Trust: 2.8
db:	SECTRACK	id:	1023095	Trust: 1.9
db:	XF	id:	53957	Trust: 0.9
db:	JVNDB	id:	JVNDB-2010-003643	Trust: 0.8
db:	CNVD	id:	CNVD-2010-5509	Trust: 0.6
db:	BUGTRAQ	id:	20091103 RE: CHEROKEE WEB SERVER 0.5.4 DENIAL OF SERVICE	Trust: 0.6
db:	BUGTRAQ	id:	20091026 CHEROKEE WEB SERVER 0.5.4 DENIAL OF SERVICE	Trust: 0.6
db:	CNNVD	id:	CNNVD-201001-045	Trust: 0.6
db:	BID	id:	79183	Trust: 0.3

sources: CNVD: CNVD-2010-5509 // BID: 36814 // BID: 79183 // JVNDB: JVNDB-2010-003643 // CNNVD: CNNVD-201001-045 // NVD: CVE-2009-4587

REFERENCES

url:	http://www.securityfocus.com/bid/36814	Trust: 2.5
url:	http://xc0re.wordpress.com/2009/10/25/cherokee-web-server-0-5-4-denial-of-service/	Trust: 1.9
url:	http://www.securitytracker.com/id?1023095	Trust: 1.9
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/53957	Trust: 1.0
url:	http://www.securityfocus.com/archive/1/507651/100/0/thread	Trust: 1.0
url:	http://www.securityfocus.com/archive/1/507456/100/0/threaded	Trust: 1.0
url:	http://xforce.iss.net/xforce/xfdb/53957	Trust: 0.9
url:	http://www.securityfocus.com/archive/1/archive/1/507651/100/0/thread	Trust: 0.9
url:	http://www.securityfocus.com/archive/1/archive/1/507456/100/0/threaded	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4587	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4587	Trust: 0.8
url:	http://www.alobbs.com/modules.php?op=modload&name=cherokee&file=index	Trust: 0.3
url:	/archive/1/507456	Trust: 0.3
url:	/archive/1/507651	Trust: 0.3

sources: CNVD: CNVD-2010-5509 // BID: 36814 // BID: 79183 // JVNDB: JVNDB-2010-003643 // CNNVD: CNNVD-201001-045 // NVD: CVE-2009-4587

CREDITS

Usman Saeed

Trust: 0.9

sources: BID: 36814 // CNNVD: CNNVD-201001-045

SOURCES

db:	CNVD	id:	CNVD-2010-5509
db:	BID	id:	36814
db:	BID	id:	79183
db:	JVNDB	id:	JVNDB-2010-003643
db:	CNNVD	id:	CNNVD-201001-045
db:	NVD	id:	CVE-2009-4587

LAST UPDATE DATE

2025-04-10T23:13:54.437000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2010-5509	date:	2010-01-07T00:00:00
db:	BID	id:	36814	date:	2015-03-19T08:27:00
db:	BID	id:	79183	date:	2010-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2010-003643	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-201001-045	date:	2010-01-08T00:00:00
db:	NVD	id:	CVE-2009-4587	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2010-5509	date:	2010-01-07T00:00:00
db:	BID	id:	36814	date:	2009-10-26T00:00:00
db:	BID	id:	79183	date:	2010-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2010-003643	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-201001-045	date:	2010-01-07T00:00:00
db:	NVD	id:	CVE-2009-4587	date:	2010-01-07T18:30:00.857