CVE-2002-2103 Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide....
MediumCVSS 5.0
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3.9 | No fix listed |
| Apache HTTP Server | = 1.3.11 | No fix listed |
| Apache HTTP Server | = 1.3.12 | No fix listed |
| Apache HTTP Server | = 1.3.13 | No fix listed |
| Apache HTTP Server | = 1.3.14 | No fix listed |
| Apache HTTP Server | = 1.3.15 | No fix listed |
| Apache HTTP Server | = 1.3.16 | No fix listed |
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
References
- www.apache.org
- apache-double-reverse-spoof(8629) patch vdb-entry
- 4358 patch vdb-entry