PT-2005-3806 · Apache · Mod Auth Shadow

David Herselman · Published 2005-10-13 · Updated 2017-07-11 · CVE-2005-2963

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod auth shadow module versions 1.0 through 1.5 and version 2.0

Description The issue allows remote authenticated users to bypass security restrictions due to the mod auth shadow module using shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified.

Recommendations For mod auth shadow module versions 1.0 through 1.5 and version 2.0, consider disabling the AuthShadow feature until a patch is available to prevent the bypassing of security restrictions.

Fix

Related Identifiers

CVE-2005-2963

DSA-844-1

Affected Products

Mod Auth Shadow

References · 10

• http://secunia.com/advisories/17060 · Vendor Advisory
• http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2963 · Security Note
• http://debian.org/security/2005/dsa-844 · Vendor Advisory
• http://secunia.com/advisories/17348 · Note
• http://secunia.com/advisories/17067 · Note
• http://securityfocus.com/bid/15224 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22520 · Note
• http://osvdb.org/19863 · Note