PT-2001-2079 · Apache · Apache+1

Publicado 2001-02-28 · Atualizado 2021-07-06 · CVE-2001-0925

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions prior to 1.3.19

Description The default installation of Apache allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters. This causes the path to be mishandled by mod negotiation, mod dir, or mod autoindex.

Recommendations For versions prior to 1.3.19, update to version 1.3.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod negotiation, mod dir, and mod autoindex modules until a patch is available. Avoid using artificially created long paths with many slashes in HTTP requests to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2001-0925

Produtos afetados

Apache

Apache Http Server

Referências · 22

• 🔥 https://exploit-db.com/exploits/20692 · Exploit
• 🔥 https://exploit-db.com/exploits/20693 · Exploit
• 🔥 https://exploit-db.com/exploits/20694 · Exploit
• 🔥 https://exploit-db.com/exploits/20695 · Exploit
• 🔥 http://securityfocus.com/archive/1/193081 · Exploit
• 🔥 http://securityfocus.com/bid/2503 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0925 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6921 · Nota
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Nota
• http://debian.org/security/2001/dsa-067 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0925 · Nota
• https://t.me/cvenotify/17155 · Publicação no Telegram
• https://httpd.apache.org/security/vulnerabilities_13.html#CVE-2001-0925 · Nota
• http://apacheweek.com/features/security-13 · Aviso do Fabricante
• http://securityfocus.com/archive/1/178066 · Nota