CVE-2002-1658 Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid....
MediumCVSS 4.6
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3.1 | No fix listed |
| Apache HTTP Server | = 1.3.3 | No fix listed |
| Apache HTTP Server | = 1.3.4 | No fix listed |
| Apache HTTP Server | = 1.3.6 | No fix listed |
| Apache HTTP Server | = 1.3.9 | No fix listed |
| Apache HTTP Server | = 1.3.11 | No fix listed |
| Apache HTTP Server | = 1.3.12 | No fix listed |
| Apache HTTP Server | = 1.3.14 | No fix listed |
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
| Apache HTTP Server | = 1.3.24 | No fix listed |
| Apache HTTP Server | = 1.3.25 | No fix listed |
| Apache HTTP Server | = 1.3.26 | No fix listed |
| Apache HTTP Server | = 1.3.27 | No fix listed |
References
- 20021016 Apache 1.3.26 mailing-list
- 5993 vdb-entry
- apache-htdigest-bo(10414) vdb-entry
- sardonix.org exploit