PT-2013-2759 · Apache+1 · Apache Http Server+1

Clint Ruoho · Published 2013-03-15 · Updated 2013-03-18 · CVE-2013-0966

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.8.3

Description The issue concerns the Apple mod hfs apple module for the Apache HTTP Server, which does not properly handle ignorable Unicode characters. This allows remote attackers to bypass intended directory authentication requirements by crafting a pathname in a URI.

Recommendations For versions prior to 10.8.3, update to version 10.8.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2013-0966

Affected Products

Apache Http Server

Macos X

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-0966 · Security Note
• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html · Vendor Advisory