PT-2002-2206 · Apache+1 · Apache+1

Published 2002-10-25 · Updated 2016-10-18 · CVE-2002-1233

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: apache-ssl versions 1.3.9 and earlier on Debian 2.2 apache-ssl versions 1.3.26 and earlier on Debian 3.0 Apache versions 1.3.27 and earlier

Description: A regression error in the apache-ssl package allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs htpasswd or htdigest. This issue is a re-introduction of a previously identified vulnerability.

Recommendations: For apache-ssl versions 1.3.9 and earlier on Debian 2.2, update to version 1.3.9 or later. For apache-ssl versions 1.3.26 and earlier on Debian 3.0, update to version 1.3.26 or later. For Apache versions 1.3.27 and earlier, update to a version later than 1.3.27.

Fix

Related Identifiers

CVE-2002-1233

DSA-187

DSA-188

DSA-195

Affected Products

Apache

Debian

References · 10

• http://debian.org/security/2002/dsa-188 · Vendor Advisory
• http://iss.net/security_center/static/10413.php · Vendor Advisory
• http://debian.org/security/2002/dsa-187 · Vendor Advisory
• http://debian.org/security/2002/dsa-195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1233 · Security Note
• http://securityfocus.com/bid/5990 · Note
• http://securityfocus.com/bid/5981 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1233 · Note
• http://iss.net/security_center/static/10412.php · Note
• http://marc.info/?l=bugtraq&m=103480856102007&w=2 · Note