PT-2013-3440 · Apache+5 · Apache Http Server+5

CVE-2013-1862 · Publicado 2013-04-19 · Atualizado 2022-09-14

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x through 2.2.24

Description The issue allows remote attackers to potentially execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. This is due to the mod rewrite module writing data to a log file without sanitizing non-printable characters.

Recommendations For Apache HTTP Server versions 2.2.x through 2.2.24, update to version 2.2.25 or later to resolve the issue.

Correção

Identificadores relacionados

ALT-PU-2015-1890

CESA-2013_0815

CVE-2013-1862

HPSBUX02927

MGASA-2013-0174

RHSA-2013:0815

RHSA-2013:1133

RHSA-2013:1207

RHSA-2013:1208

RHSA-2013_0815

SUSE-SU-2013_1381-1

SUSE-SU-2013_1824-1

SUSE-SU-2014_1082-1

SUSE-SU-2015:0689-1

Produtos afetados

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

Referências · 126

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E · Nota
• http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2013:0815 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534 · Nota
• http://support.novell.com/security/cve/CVE-2014-0226.html · Nota
• https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0815.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 · Nota de Segurança
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMzkyMjQwNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota