PT-2000-1791 · Suse+1 · Suse Linux+1

Published 2000-11-14 · Updated 2017-10-10 · CVE-2000-0868

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache version 1.3.12

Description The default configuration of Apache in SuSE Linux allows remote attackers to read source code for CGI scripts by modifying the requested URL. Specifically, replacing the /cgi-bin/ in the URL with /cgi-bin-sdb/ enables this unauthorized access.

Recommendations For Apache version 1.3.12, consider reconfiguring the server to prevent information disclosure by restricting access to CGI scripts and modifying the default URL handling to prevent source code exposure. As a temporary workaround, restrict access to the /cgi-bin-sdb/ endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2000-0868

Affected Products

Apache

Suse Linux

References · 6

• http://atstake.com/research/advisories/2000/a090700-2.txt · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/suse/2000-q3/0906.html · Vendor Advisory
• http://securityfocus.com/bid/1658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0868 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5197 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0868 · Note