PT-2003-1994 · Apache · Mod Digest+2

Published 2003-12-18 · Updated 2021-06-06 · CVE-2003-0987

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod digest for Apache versions prior to 1.3.31

Description The issue concerns the improper verification of the nonce of a client response by mod digest, which could allow a malicious user to conduct a replay attack against a website using Digest protection. This is possible if the attacker can sniff network traffic. Note that mod digest implements an older version of the MD5 Digest Authentication specification, which is known to be incompatible with modern browsers.

Recommendations For mod digest for Apache versions prior to 1.3.31, update to version 1.3.31 or later to resolve the issue.

Fix

Related Identifiers

CVE-2003-0987

Affected Products

Apache

Apache Http Server

Mod Digest

References · 28

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1 · Vendor Advisory
• http://securityfocus.com/bid/9571 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200405-22.xml · Vendor Advisory
• http://trustix.org/errata/2004/0027 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-600.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-816.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0987 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:046 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.529643 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4416 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3E · Note