PT-2005-3806 · Apache · Mod Auth Shadow

David Herselman · Publicado 2005-10-13 · Atualizado 2017-07-11 · CVE-2005-2963

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod auth shadow module versions 1.0 through 1.5 and version 2.0

Description The issue allows remote authenticated users to bypass security restrictions due to the mod auth shadow module using shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified.

Recommendations For mod auth shadow module versions 1.0 through 1.5 and version 2.0, consider disabling the AuthShadow feature until a patch is available to prevent the bypassing of security restrictions.

Correção

Identificadores relacionados

CVE-2005-2963

DSA-844-1

Produtos afetados

Mod Auth Shadow

Referências · 10

• http://secunia.com/advisories/17060 · Aviso do Fabricante
• http://secunia.com/advisories/17348 · Nota
• http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200 · Aviso do Fabricante
• http://secunia.com/advisories/17067 · Nota
• http://securityfocus.com/bid/15224 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2963 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22520 · Nota
• http://debian.org/security/2005/dsa-844 · Aviso do Fabricante
• http://osvdb.org/19863 · Nota