PT-2002-1688 · Apache · Apache+1

Published 2002-08-09 · Updated 2021-06-06 · CVE-2002-0654

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 2.0 through 2.0.39

Description The issue allows remote attackers to determine the full pathname of the server. This can occur through a request for a .var file, which leaks the pathname in the resulting error message. Additionally, an error message that occurs when a script (child process) cannot be invoked also reveals the full path of the script. This exposure is present in multiview type map negotiation, such as the default error documents, where a module reports the full path of the typemapped .var file when multiple documents or no documents could be served.

Recommendations For Apache versions 2.0 through 2.0.39, consider updating to a version that addresses this issue, as the current version allows remote attackers to determine the server's full pathname. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0654

Affected Products

Apache

Apache Http Server

References · 23

• 🔥 https://exploit-db.com/exploits/21719 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-0654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0654 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2002-0654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-0654 · Vendor Advisory
• http://apache.org/dist/httpd/CHANGES_2.0 · Vendor Advisory
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• http://securityfocus.com/bid/5485 · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• http://marc.info/?l=bugtraq&m=102951160411052&w=2 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• http://iss.net/security_center/static/9875.php · Note
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Note