PT-2001-2641 · Apache · Apache Web Server

Published 2001-12-31 · Updated 2020-10-14 · CVE-2001-1556

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache web server (affected versions not specified)

Description The issue concerns the logging mechanism in the Apache web server, where log files contain unfiltered information directly supplied by clients, including control characters. This could allow remote attackers to manipulate log entries, potentially hiding HTTP requests or spoofing source IP addresses when logs are viewed using UNIX programs like cat, tail, and grep.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2001-1556

Affected Products

Apache Web Server

References · 5

• http://httpd.apache.org/docs/logs.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1556 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1556 · Note
• http://iss.net/security_center/static/7363.php · Note