PT-2003-1356 · Red Hat+1 · Red Hat+1

Daniel Jarboe + 1 · Published 2003-04-29 · Updated 2017-07-11 · CVE-2003-0084

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux version 2.1 mod auth any (affected versions not specified)

Description The issue is related to the mod auth any package, which does not properly escape arguments when calling other programs. This allows attackers to execute arbitrary commands via shell metacharacters.

Recommendations For Red Hat Enterprise Linux version 2.1, update the mod auth any package to a version that properly escapes arguments. For mod auth any, consider disabling the execution of external programs until a patch is available.

Fix

Related Identifiers

CVE-2003-0084

Affected Products

Red Hat

Mod Auth Any

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2003-0084 · Security Note
• http://redhat.com/support/errata/RHSA-2003-113.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2003-114.html · Vendor Advisory
• http://securityfocus.com/bid/7448 · Vendor Advisory
• http://itlab.musc.edu/webNIS/mod_auth_any.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11893 · Note
• http://ciac.org/ciac/bulletins/n-090.shtml · Note