PT-2001-2641 · Apache · Apache Web Server

Publicado 2001-12-31 · Atualizado 2020-10-14 · CVE-2001-1556

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache web server (affected versions not specified)

Description The issue concerns the logging mechanism in the Apache web server, where log files contain unfiltered information directly supplied by clients, including control characters. This could allow remote attackers to manipulate log entries, potentially hiding HTTP requests or spoofing source IP addresses when logs are viewed using UNIX programs like cat, tail, and grep.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2001-1556

Produtos afetados

Apache Web Server

Referências · 5

• http://httpd.apache.org/docs/logs.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1556 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1556 · Nota
• http://iss.net/security_center/static/7363.php · Nota