PT-2002-2317 · Apache · Apache+1

Publicado 2002-04-22 · Atualizado 2021-06-06 · CVE-2002-1592

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 2.0 through 2.035

Description The issue allows remote attackers to obtain sensitive information when a CGI application encounters an error. Specifically, error messages sent to the client include the full path for the server. This could reveal the path to a CGI script, presenting a minor security exposure. In some cases, warning messages could get returned to end users in addition to being recorded in the error log.

Recommendations For Apache versions 2.0 through 2.035, consider restricting access to error messages and warning logs to minimize the risk of sensitive information disclosure until a fix is available. As a temporary workaround, modify the ap log rerror function to exclude the full server path from error messages sent to clients.

Correção

Identificadores relacionados

CVE-2002-1592

Produtos afetados

Apache

Apache Http Server

Referências · 22

• http://apache.org/dist/httpd/CHANGES_2.0 · Nota
• http://kb.cert.org/vuls/id/165803 · Nota
• https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1592 · Nota
• http://securityfocus.com/bid/5256 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1592 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2002-1592 · Aviso do Fabricante