PT-2003-1910 · Apache · Mod Gzip

Matthew Murphy · Publicado 2003-10-09 · Atualizado 2016-10-18 · CVE-2003-0843

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod gzip versions 1.3.26.1a and earlier

Description The issue allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header, when mod gzip is running in debug mode and using the Apache log.

Recommendations For mod gzip versions 1.3.26.1a and earlier, consider disabling the debug mode as a temporary workaround until a patch is available. Restrict access to the Apache log to minimize the risk of exploitation. Avoid using format string characters in HTTP GET requests with an "Accept-Encoding: gzip" header until the issue is resolved.

Correção

Identificadores relacionados

CVE-2003-0843

Produtos afetados

Mod Gzip

Referências · 2

• http://marc.info/?l=bugtraq&m=105457180009860&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0843 · Nota de Segurança