PT-2010-1201 · Apache+1 · Apache Http Server+1

Published 2010-02-05 · Updated 2010-02-08 · CVE-2003-1581

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.0.44

Description The issue allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response. This can be used to inject XSS sequences, and is related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Recommendations For Apache HTTP Server version 2.0.44, consider disabling DNS resolution for client IP addresses as a temporary workaround to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2003-1581

ECHO-2734-798D-A68B

Affected Products

Apache Http Server

Debian

References · 5

• 🔥 http://securityfocus.com/archive/1/313867 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1581 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-1581 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1581 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-1581 · Vendor Advisory