PT-2006-2107 · Apache · Htpasswd

Larry Cashdollar · Published 2006-03-09 · Updated 2023-11-28 · CVE-2006-1079

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions htpasswd versions 2.25b and earlier

Description The issue allows local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. This could potentially be exploited in configurations where htpasswd is used with sudo privileges or accessed remotely.

Recommendations For htpasswd version 2.25b and earlier, consider restricting the use of command line options to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using htpasswd with sudo privileges or remote access to reduce the risk of privilege escalation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-1079

Affected Products

Htpasswd

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-1079 · Security Note
• http://securityfocus.com/archive/1/426823/100/0/threaded · Note
• http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25217 · Note
• http://securityfocus.com/bid/16972 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1079 · Note
• http://seclists.org/fulldisclosure/2023/Nov/13 · Note
• https://t.me/cvenotify/61343 · Telegram Post
• http://marc.info/?l=thttpd&m=114153031201867&w=2 · Note
• http://marc.info/?l=thttpd&m=114154083000296&w=2 · Note
• http://osvdb.org/23828 · Note