CVE-2010-0425 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 94.2% (pctl 100)
Patch early
A public exploit exists.
Description
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 94.25% — more likely to be exploited than 100% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-03-05 |
| Last modified | 2026-06-16 |
Affected (6)
| Vendor | Product |
|---|---|
| apache | http server |
| broadcom | vmware ace management server |
| ibm | http server |
| ibm | websphere application server |
| microsoft | windows |
| oracle | http server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM | 2010-03-07 |
References
- http://httpd.apache.org/security/vulnerabilities_20.html
- http://httpd.apache.org/security/vulnerabilities_22.html
- http://lists.vmware.com/pipermail/security-announce/2010/000105.html
- http://secunia.com/advisories/38978
- http://secunia.com/advisories/39628
- http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870
- http://svn.apache.org/viewvc?view=revision&revision=917870
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247
- http://www.kb.cert.org/vuls/id/280613
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- http://www.securityfocus.com/bid/38494
- http://www.securitytracker.com/id?1023701
- http://www.senseofsecurity.com.au/advisories/SOS-10-002
- http://www.vmware.com/security/advisories/VMSA-2010-0014.html
- http://www.vupen.com/english/advisories/2010/0634
- http://www.vupen.com/english/advisories/2010/0994
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56624
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
→ the Explorer · watch your stack · NVD