PT-2000-1825 · Apache · Apache+1

Published 2000-09-29 · Updated 2021-06-06 · CVE-2000-0913

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 1.3.12 and earlier

Description The issue allows remote attackers to read arbitrary files on the web server under specific conditions. This occurs when the RewriteRule directive in the mod rewrite module is expanded to include a filename containing a regular expression, enabling access to any file on the server.

Recommendations For Apache versions 1.3.12 and earlier, consider disabling the mod rewrite module or restricting its use to minimize the risk of exploitation until a fix is available. As a temporary workaround, review and modify RewriteRule directives to avoid using regular expression references in the destination, thereby preventing unauthorized file access.

Fix

Related Identifiers

CVE-2000-0913

Affected Products

Apache

Apache Http Server

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2000-0913 · Security Note
• http://securityfocus.com/bid/1728 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_13.html#CVE-2000-0913 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0913 · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-09/0352.html · Note
• http://linux-mandrake.com/en/security/MDKSA-2000-060-2.php3?dis=7.1 · Note
• https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E · Note
• http://redhat.com/support/errata/RHSA-2000-088.html · Note
• http://redhat.com/support/errata/RHSA-2000-095.html · Note
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E · Note
• http://calderasystems.com/support/security/advisories/CSSA-2000-035.0.txt · Note
• https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E · Note