HOME VULNERABILITIESCVE-2011-0419

MEDIUMPOC

CVE-2011-0419

CWE-770Published: May 16, 2011· Updated: Jun 16, 2026

4.3

CVSS v3.1

Official Description

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.

Technical Analysis

CVE-2011-0419 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2011-0419. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityM

Privileges Req.

User Interaction

Scope

Impact

ConfidentialityNone

IntegrityNone

AvailabilityP

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected Vendors & Products

Apache2 product(s)

portable runtimehttp server

Apple1 product(s)

mac os x

Debian1 product(s)

debian linux

freebsd1 product(s)

freebsd

Google1 product(s)

android

netbsd1 product(s)

netbsd

openbsd1 product(s)

openbsd

Oracle1 product(s)

solaris

SUSE1 product(s)

linux enterprise server

Source: NVD CPE · 12 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://cxib.net/stuff/apache.fnmatch.phps

PATCHhttp://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902

PATCHhttp://svn.apache.org/viewvc?view=revision&revision=1098188

PATCHhttp://svn.apache.org/viewvc?view=revision&revision=1098799

PATCHhttp://www.apache.org/dist/apr/Announcement1.x.html

PATCHhttp://www.apache.org/dist/httpd/Announcement2.2.html

PATCHhttps://bugzilla.redhat.com/show_bug.cgi?id=703390

PATCHhttp://cxib.net/stuff/apache.fnmatch.phps

PATCHhttp://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902

PATCHhttp://svn.apache.org/viewvc?view=revision&revision=1098188

PATCHhttp://svn.apache.org/viewvc?view=revision&revision=1098799

PATCHhttp://www.apache.org/dist/apr/Announcement1.x.html

PATCHhttp://www.apache.org/dist/httpd/Announcement2.2.html

PATCHhttps://bugzilla.redhat.com/show_bug.cgi?id=703390

ADVISORYhttp://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22

ADVISORYhttp://cxib.net/stuff/apr_fnmatch.txts

ADVISORYhttp://httpd.apache.org/security/vulnerabilities_22.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

ADVISORYhttp://marc.info/?l=bugtraq&m=131551295528105&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=131731002122529&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=132033751509019&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=134987041210674&w=2

ADVISORYhttp://secunia.com/advisories/44490

ADVISORYhttp://secunia.com/advisories/44564

ADVISORYhttp://secunia.com/advisories/44574

ADVISORYhttp://securityreason.com/achievement_securityalert/98

ADVISORYhttp://securityreason.com/securityalert/8246

ADVISORYhttp://securitytracker.com/id?1025527

ADVISORYhttp://support.apple.com/kb/HT5002

ADVISORYhttp://www.debian.org/security/2011/dsa-2237

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23960.html

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23961.html

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23976.html

ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0507.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0896.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0897.html

ADVISORYhttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804

ADVISORYhttp://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22

ADVISORYhttp://cxib.net/stuff/apr_fnmatch.txts

ADVISORYhttp://httpd.apache.org/security/vulnerabilities_22.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

ADVISORYhttp://marc.info/?l=bugtraq&m=131551295528105&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=131731002122529&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=132033751509019&w=2

ADVISORYhttp://marc.info/?l=bugtraq&m=134987041210674&w=2

ADVISORYhttp://secunia.com/advisories/44490

ADVISORYhttp://secunia.com/advisories/44564

ADVISORYhttp://secunia.com/advisories/44574

ADVISORYhttp://securityreason.com/achievement_securityalert/98

ADVISORYhttp://securityreason.com/securityalert/8246

ADVISORYhttp://securitytracker.com/id?1025527

ADVISORYhttp://support.apple.com/kb/HT5002

ADVISORYhttp://www.debian.org/security/2011/dsa-2237

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23960.html

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23961.html

ADVISORYhttp://www.mail-archive.com/dev%40apr.apache.org/msg23976.html

ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0507.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0896.html

ADVISORYhttp://www.redhat.com/support/errata/RHSA-2011-0897.html

ADVISORYhttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638

ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804

All References (116)

→

http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22Third Party Advisory

→

http://cxib.net/stuff/apache.fnmatch.phpsPatch · Third Party Advisory

→

http://cxib.net/stuff/apr_fnmatch.txtsThird Party Advisory

→

http://httpd.apache.org/security/vulnerabilities_22.htmlVendor Advisory

→

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlBroken Link

→

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.htmlMailing List · Third Party Advisory

→

http://marc.info/?l=bugtraq&m=131551295528105&w=2Issue Tracking · Mailing List · Third Party Advisory

→

http://marc.info/?l=bugtraq&m=131731002122529&w=2Issue Tracking · Mailing List · Third Party Advisory

→

http://marc.info/?l=bugtraq&m=132033751509019&w=2Issue Tracking · Mailing List · Third Party Advisory

→

http://marc.info/?l=bugtraq&m=134987041210674&w=2Issue Tracking · Mailing List · Third Party Advisory

→

http://secunia.com/advisories/44490Not Applicable · Vendor Advisory

→

http://secunia.com/advisories/44564Not Applicable · Vendor Advisory

→

http://secunia.com/advisories/44574Not Applicable · Vendor Advisory

→

http://secunia.com/advisories/48308Not Applicable

→

http://securityreason.com/achievement_securityalert/98Exploit · Third Party Advisory

Quick Facts

CVE IDCVE-2011-0419

CVSS Score4.3 / 10

SeverityMEDIUM

WeaknessCWE-770

CISA KEVNo

ExploitPOC

Affected9 vendor(s)

PublishedMay 16, 2011

Related CVEs (CWE-770)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2011-0419 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2011-0419·NVD