PT-2010-1200 · Apache+1 · Apache Http Server+1

Publicado 2010-02-05 · Atualizado 2010-02-08 · CVE-2003-1580

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.0.44

Description The issue occurs when DNS resolution is enabled for client IP addresses, allowing remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains. This is related to an "Inverse Lookup Log Corruption (ILLC)" issue, where the logging format does not identify whether a dotted quad represents an unresolved IP address.

Recommendations For Apache HTTP Server version 2.0.44, consider disabling DNS resolution for client IP addresses as a temporary workaround to minimize the risk of IP address spoofing.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2003-1580

ECHO-19A7-8D2C-488F

Produtos afetados

Apache Http Server

Debian

Referências · 5

• 🔥 http://securityfocus.com/archive/1/313867 · Exploit
• https://osv.dev/vulnerability/CVE-2003-1580 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1580 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-1580 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-1580 · Nota de Segurança