PT-2006-2107 · Apache · Htpasswd

Larry Cashdollar · Publicado 2006-03-09 · Atualizado 2023-11-28 · CVE-2006-1079

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions htpasswd versions 2.25b and earlier

Description The issue allows local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. This could potentially be exploited in configurations where htpasswd is used with sudo privileges or accessed remotely.

Recommendations For htpasswd version 2.25b and earlier, consider restricting the use of command line options to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using htpasswd with sudo privileges or remote access to reduce the risk of privilege escalation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-1079

Produtos afetados

Htpasswd

Referências · 11

• http://securityfocus.com/archive/1/426823/100/0/threaded · Nota
• http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25217 · Nota
• http://securityfocus.com/bid/16972 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1079 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1079 · Nota
• http://seclists.org/fulldisclosure/2023/Nov/13 · Nota
• https://t.me/cvenotify/61343 · Publicação no Telegram
• http://marc.info/?l=thttpd&m=114153031201867&w=2 · Nota
• http://marc.info/?l=thttpd&m=114154083000296&w=2 · Nota
• http://osvdb.org/23828 · Nota