PT-2004-2733 · Apache · Apache+1

Published 2004-03-20 · Updated 2021-06-06 · CVE-2004-1834

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 2.0 through 2.0.49

Description The issue concerns the storage of client headers, including authentication information, on the hard disk by the mod disk cache module. This could potentially allow local users to gain access to sensitive information, such as proxy authentication credentials and Basic Authentication passwords, for cached objects.

Recommendations For Apache versions 2.0 through 2.0.49, consider disabling the mod disk cache module to prevent the storage of sensitive authentication information on disk until a proper fix is available. Restrict access to the cached objects to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1834

RHSA-2004:562

Affected Products

Apache

Apache Http Server

References · 31

• 🔥 http://osvdb.org/4446 · Exploit
• 🔥 http://securitytracker.com/id?1009509 · Exploit
• 🔥 http://secunia.com/advisories/11176 · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 · Vendor Advisory
• http://securityfocus.com/bid/9933 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-1834 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-1834 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-562.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1834 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1834 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15547 · Note
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://httpd.apache.org/security/vulnerabilities_20.html#CVE-2004-1834 · Note
• https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11133 · Note