PT-2002-2317 · Apache · Apache+1

Published 2002-04-22 · Updated 2021-06-06 · CVE-2002-1592

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 2.0 through 2.035

Description The issue allows remote attackers to obtain sensitive information when a CGI application encounters an error. Specifically, error messages sent to the client include the full path for the server. This could reveal the path to a CGI script, presenting a minor security exposure. In some cases, warning messages could get returned to end users in addition to being recorded in the error log.

Recommendations For Apache versions 2.0 through 2.035, consider restricting access to error messages and warning logs to minimize the risk of sensitive information disclosure until a fix is available. As a temporary workaround, modify the ap log rerror function to exclude the full server path from error messages sent to clients.

Fix

Related Identifiers

CVE-2002-1592

Affected Products

Apache

Apache Http Server

References · 22

• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1592 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1592 · Security Note
• https://osv.dev/vulnerability/CVE-2002-1592 · Vendor Advisory
• http://apache.org/dist/httpd/CHANGES_2.0 · Note
• http://kb.cert.org/vuls/id/165803 · Note
• https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1592 · Note
• http://securityfocus.com/bid/5256 · Note
• https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E · Note