CVE-2003-1580 The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which all...
MediumCVSS 4.3
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 2.0.44 | No fix listed |
| debian/apache2(Debian:12) | All versions | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.58-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb10u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.60-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.63-1 | No fix listed |
Show 102 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | = 2.4.64-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | All versions | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | All versions | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1~deb13u1 | No fix listed |
References
- 20030304 Log corruption on multiple webservers, log analyzers,... exploit mailing-list
- Debian Security Tracker CVE-2003-1580 vendor-advisory
- bugs.debian.org issue-tracking