PT-2003-1995 · Apache · Apache+1

Published 2003-10-15 · Updated 2021-06-06 · CVE-2003-0993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache versions prior to 1.3.30

Description The issue arises from improper parsing of Allow/Deny rules using IP addresses without a netmask on big-endian 64-bit platforms. This could allow remote attackers to bypass intended access restrictions. A bug in the parsing of these rules causes them to fail to match as intended.

Recommendations For Apache versions prior to 1.3.30, update to version 1.3.30 or later to resolve the issue. As a temporary workaround, consider using IP addresses with a netmask in Allow/Deny rules to minimize the risk of exploitation. Restrict access to sensitive areas of the server until the update can be applied.

Fix

Related Identifiers

CVE-2003-0993

Affected Products

Apache

Apache Http Server

References · 26

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0993 · Security Note
• http://apacheweek.com/features/security-13 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200405-22.xml · Vendor Advisory
• http://trustix.org/errata/2004/0027 · Vendor Advisory
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:046 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.529643 · Vendor Advisory
• http://securityfocus.com/bid/9829 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15422 · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4670 · Note
• https://httpd.apache.org/security/vulnerabilities_13.html#CVE-2003-0993 · Note
• https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E · Note