CVE-2002-1233 A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or mod...
LowCVSS 2.6
EPSS 0.56%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
| Apache HTTP Server | = 1.3.24 | No fix listed |
| Apache HTTP Server | = 1.3.25 | No fix listed |
| Apache HTTP Server | = 1.3.26 | No fix listed |
| Apache HTTP Server | = 1.3.27 | No fix listed |
References
- 20021016 Apache 1.3.26 mailing-list
- DSA-187 vendor-advisory
- DSA-188 vendor-advisory
- DSA-195 vendor-advisory
- apache-htpasswd-tmpfile-race(10412) vdb-entry
- apache-htdigest-tmpfile-race(10413) vdb-entry vendor-advisory
- 5981 vdb-entry
- 5990 vdb-entry