PT-2002-1690 · Apache · Apache+1

Published 2002-08-09 · Updated 2021-06-06 · CVE-2002-0661

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache versions 2.0 through 2.0.39

Description The issue allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing (backslash) characters. Certain URIs can bypass security and allow users to invoke or access any file depending on the system configuration. This affects Windows, OS2, Netware, and Cygwin platforms.

Recommendations For Apache versions 2.0 through 2.0.39, consider restricting access to sensitive files and directories to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of .. (dot dot) sequences containing (backslash) characters in URIs until a patch is available. Restrict access to sensitive URIs to prevent bypassing security measures.

Exploit

Fix

Related Identifiers

CVE-2002-0661

Affected Products

Apache

Apache Http Server

References · 24

• 🔥 https://exploit-db.com/exploits/21697 · Exploit
• http://httpd.apache.org/info/security_bulletin_20020908a.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-0661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0661 · Security Note
• https://osv.dev/vulnerability/CVE-2002-0661 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-0661 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102892744011436&w=2 · Note
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• http://iss.net/security_center/static/9808.php · Note
• https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://httpd.apache.org/security/vulnerabilities_20.html#CVE-2002-0661 · Note
• http://marc.info/?l=bugtraq&m=102951160411052&w=2 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Note