PT-2002-2382 · Apache · Apache

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1658

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache versions 1.3.26 through 1.3.27

Description A buffer overflow issue exists in the htdigest component, potentially allowing attackers to execute arbitrary code via a long user argument. However, since htdigest is typically only locally accessible and not setuid or setgid, there are limited attack vectors that could lead to an escalation of privileges, unless htdigest is executed from a CGI program.

Recommendations For Apache versions 1.3.26 and 1.3.27, consider restricting access to the htdigest component to minimize the risk of exploitation, especially if it is executed from a CGI program. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2002-1658

Affected Products

Apache

References · 6

• 🔥 https://sardonix.org/audit/apache-45.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1658 · Security Note
• http://securityfocus.com/bid/5993 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10414 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1658 · Note
• http://marc.info/?l=bugtraq&m=103480856102007&w=2 · Note