CVE-2001-1534 mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain sess...
LowCVSS 2.1
EPSS 0.76%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | >= 1.3.11, <= 1.3.20 | No fix listed |
| debian/apache2(Debian:12) | All versions | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.58-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb10u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.60-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.63-1 | No fix listed |
Show 102 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | = 2.4.64-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | All versions | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | All versions | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1~deb13u1 | No fix listed |
References
- 20011113 Brute-Forcing Web Application Session IDs broken-link mailing-list
- apache-modusertrack-predicticable-sessionid(7494) broken-link vdb-entry
- 3521 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2001-1534 vendor-advisory