A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.

According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache server package, a commonly used webserver. Most of the code is shared between the Apache and Apache-Perl packages, so vulnerabilities are shared as well.

These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross site scripting attack, or steal cookies from other website users. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

  - CAN-2002-0839: A vulnerability exists on platforms using     System V shared memory based scoreboards. This     vulnerability allows an attacker to execute code under     the Apache UID to exploit the Apache shared memory     scoreboard format and send a signal to any process as     root or cause a local denial of service attack.
  - CAN-2002-0840: Apache is susceptible to a cross site     scripting vulnerability in the default 404 page of any     web server hosted on a domain that allows wildcard DNS     lookups.

  - CAN-2002-0843: There were some possible overflows in the     utility ApacheBench (ab) which could be exploited by a     malicious server. No such binary programs are     distributed by the Apache-Perl package, though.

  - CAN-2002-1233: A race condition in the htpasswd and     htdigest program enables a malicious local user to read     or even modify the contents of a password file or easily     create and overwrite files as the user running the     htpasswd (or htdigest respectively) program. No such     binary programs are distributed by the Apache-Perl     package, though.

  - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9,     1.3.14, and others allows local users to overwrite     arbitrary files via a symlink attack. No such binary     programs are distributed by the Apache-Perl package,     though.

  - NO-CAN: Several buffer overflows have been found in the     ApacheBench (ab) utility that could be exploited by a     remote server returning very long strings. No such     binary programs are distributed by the Apache-Perl     package, though.

These problems have been fixed in version 1.3.26-1-1.26-0woody2 for the current stable distribution (woody), in 1.3.9-14.1-1.21.20000309-1.1 for the old stable distribution (potato) and in version 1.3.26-1.1-1.27-3-1 for the unstable distribution (sid).

According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache package, a commonly used webserver. Most of the code is shared between the Apache and Apache-SSL packages, so vulnerabilities are shared as well. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack, or steal cookies from other web site users. Vulnerabilities in the included legacy programs htdigest, htpasswd and ApacheBench can be exploited when called via CGI. Additionally the insecure temporary file creation in htdigest and htpasswd can also be exploited locally.
The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

  - CAN-2002-0839: A vulnerability exists on platforms using     System V shared memory based scoreboards. This     vulnerability allows an attacker to execute code under     the Apache UID to exploit the Apache shared memory     scoreboard format and send a signal to any process as     root or cause a local denial of service attack.
  - CAN-2002-0840: Apache is susceptible to a cross site     scripting vulnerability in the default 404 page of any     web server hosted on a domain that allows wildcard DNS     lookups.

  - CAN-2002-0843: There were some possible overflows in the     utility ApacheBench (ab) which could be exploited by a     malicious server.

  - CAN-2002-1233: A race condition in the htpasswd and     htdigest program enables a malicious local user to read     or even modify the contents of a password file or easily     create and overwrite files as the user running the     htpasswd (or htdigest respectively) program. (binaries     not included in apache-ssl package though)

  - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9,     1.3.14, and others allows local users to overwrite     arbitrary files via a symlink attack.

    This is the same vulnerability as CAN-2002-1233, which     was fixed in potato already but got lost later and was     never applied upstream. (binaries not included in     apache-ssl package though)

  - NO-CAN: Several buffer overflows have been found in the     ApacheBench (ab) utility that could be exploited by a     remote server returning very long strings. (binary not     included in apache-ssl package though) These problems have been fixed in version 1.3.26.1+1.48-0woody3 for the current stable distribution (woody) and in 1.3.9.13-4.2 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.

According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several remotely exploitable vulnerabilities have been found in the Apache package, a commonly used webserver. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities :

  - CAN-2002-0839: A vulnerability exists on platforms using     System V shared memory based scoreboards. This     vulnerability allows an attacker to execute code under     the Apache UID to exploit the Apache shared memory     scoreboard format and send a signal to any process as     root or cause a local denial of service attack.
  - CAN-2002-0840: Apache is susceptible to a cross site     scripting vulnerability in the default 404 page of any     web server hosted on a domain that allows wildcard DNS     lookups.

  - CAN-2002-0843: There were some possible overflows in the     utility ApacheBench (ab) which could be exploited by a     malicious server.

  - CAN-2002-1233: A race condition in the htpasswd and     htdigest program enables a malicious local user to read     or even modify the contents of a password file or easily     create and overwrite files as the user running the     htpasswd (or htdigest respectively) program.

  - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9,     1.3.14, and others allows local users to overwrite     arbitrary files via a symlink attack.

    This is the same vulnerability as CAN-2002-1233, which     was fixed in potato already but got lost later and was     never applied upstream.

  - NO-CAN: Several buffer overflows have been found in the     ApacheBench (ab) utility that could be exploited by a     remote server returning very long strings.
These problems have been fixed in version 1.3.26-0woody3 for the current stable distribution (woody) and in 1.3.9-14.3 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.

ID	Name	Product	Family	Severity
15032	Debian DSA-195-1 : apache-perl - several vulnerabilities	Nessus	Debian Local Security Checks	high
15025	Debian DSA-188-1 : apache-ssl - several vulnerabilities	Nessus	Debian Local Security Checks	high
15024	Debian DSA-187-1 : apache - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2002-1233

high

Tenable Plugins

high

high

high