WaratekVRT Sign in

CVE-2010-0425

Affected software3 products, listed below
Severity10.0 High CVSS 2.0
Published5 Mar 2010
Updated16 Jun 2026

Description

modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2010-03-07.
  • EPSS 94% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM 2010-03-07

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2013 ↗ CPU 2013-Q3 Oracle Fusion Middleware / Web Listener (10.1.3.5.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Web Listener 10.1.3.5.0 10.1.3.5.0

Products and versions

5 products, 41 version entries
SourceVendorProductSchemeAffected versions
nvd apache http server generic ≥ 2.0.37 and ＜ 2.0.64 · ≥ 2.2.0 and ＜ 2.2.15 · ≥ 2.3.0 and ＜ 2.3.7
nvd broadcom vmware ace management server generic ＜ 2.7.2
nvd ibm http server generic 6.0.2 · 6.0.2.1 · 6.0.2.3 · 6.0.2.7 · 6.0.2.9 · 6.0.2.11 · 6.0.2.13 · 6.0.2.15 · 6.0.2.19 · 6.0.2.21 · 6.0.2.23 · 6.0.2.25 · 6.0.2.27 · 6.0.2.29 · 6.0.2.31 · 6.0.2.33 · 6.0.2.35 · 6.0.2.37 · 6.0.2.39 · 6.1 · 6.1.0.2 · 6.1.0.3 · 6.1.0.5 · 6.1.0.7 · 6.1.0.9 · 6.1.0.11 · 6.1.0.13 · 6.1.0.15 · 6.1.0.17 · 6.1.0.19 · 6.1.0.21 · 6.1.0.23 · 6.1.0.25 · 6.1.0.27 · 6.1.0.29
nvd ibm websphere application server generic ≥ 6.1 and ＜ 6.1.0.31
nvd oracle http server generic 10.1.3.5.0

References

URLTags
http://httpd.apache.org/security/vulnerabilities_20.html Vendor Advisory
http://httpd.apache.org/security/vulnerabilities_22.html Vendor Advisory
http://lists.vmware.com/pipermail/security-announce/2010/000105.html Broken Link
http://secunia.com/advisories/38978 Broken Link
http://secunia.com/advisories/39628 Broken Link
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870 Permissions Required
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870 Permissions Required
http://svn.apache.org/viewvc?view=revision&revision=917870 Permissions Required
http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447 Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247 Third Party Advisory

Timeline
Published2010-03-05By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.