7.5 - CVE-2003-0987

Executive Summary

Informations
Name	CVE-2003-0987	First vendor Publication	2004-03-03
Vendor	Cve	Last vendor Modification	2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0987

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:100108

Oval ID:	oval:org.mitre.oval:def:100108
Title:	Apache Nonce Verification Response Replay Vulnerability
Description:	mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2003-0987	Version:	1
Platform(s):	Sun Solaris 8 Sun Solaris 9	Product(s):	Apache
Definition Synopsis:
Solaris 8 (SPARC) meets Sun Alert ID 101555 criteria. Solaris 8 Installed AND sparc architecture AND NOT Patch 116973-02 or later installed OR Solaris 8 (x86) meets Sun Alert ID 101555 criteria. Solaris 8 Installed AND ix86 architecture AND NOT Patch 116974-02 or later installed OR Solaris 9 (SPARC) meets Sun Alert ID 101555 criteria. Solaris 9 Installed AND sparc architecture AND NOT Patch 113146-05 or later installed OR Solaris 9 (x86) meets Sun Alert ID 101555 criteria. Solaris 9 Installed AND ix86 architecture AND NOT Patch 114145-04 or later installed AND Apache running (httpd)

Definition Id: oval:org.mitre.oval:def:4416

Oval ID:	oval:org.mitre.oval:def:4416
Title:	Apache mod_digest Nonce Verification Vulnerability
Description:	mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2003-0987	Version:	1
Platform(s):	Sun Solaris 8 Sun Solaris 9	Product(s):	Apache
Definition Synopsis:
Software section Solaris 8 or 9 installed Solaris 8 Installed AND Solaris 9 Installed AND NOT Patch 116973-01 or later installed AND NOT Patch 113146-05 or later installed AND Apache (SUNWapchu) installed AND Configuration section Apache running (httpd)

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Http Server cpe:2.3:a:apache:http_server:1.3.9:::::::* cpe:2.3:a:apache:http_server:1.3.9::win32::::: cpe:2.3:a:apache:http_server:1.3.8:::::::* cpe:2.3:a:apache:http_server:1.3.7::dev::::: cpe:2.3:a:apache:http_server:1.3.7:::::::* cpe:2.3:a:apache:http_server:1.3.6:::::::* cpe:2.3:a:apache:http_server:1.3.6::win32::::: cpe:2.3:a:apache:http_server:1.3.5:::::::* cpe:2.3:a:apache:http_server:1.3.4:::::::* cpe:2.3:a:apache:http_server:1.3.30:::::::* cpe:2.3:a:apache:http_server:1.3.3:::::::* cpe:2.3:a:apache:http_server:1.3.29:::::::* cpe:2.3:a:apache:http_server:1.3.28:::::::* cpe:2.3:a:apache:http_server:1.3.27:::::::* cpe:2.3:a:apache:http_server:1.3.26:::::::* cpe:2.3:a:apache:http_server:1.3.26::win32::::: cpe:2.3:a:apache:http_server:1.3.25::win32::::: cpe:2.3:a:apache:http_server:1.3.25:::::::* cpe:2.3:a:apache:http_server:1.3.24::win32::::: cpe:2.3:a:apache:http_server:1.3.24:::::::* cpe:2.3:a:apache:http_server:1.3.23:::::::* cpe:2.3:a:apache:http_server:1.3.23::win32::::: cpe:2.3:a:apache:http_server:1.3.22::win32::::: cpe:2.3:a:apache:http_server:1.3.22:::::::* cpe:2.3:a:apache:http_server:1.3.20::win32::::: cpe:2.3:a:apache:http_server:1.3.20:::::::* cpe:2.3:a:apache:http_server:1.3.2:::::::* cpe:2.3:a:apache:http_server:1.3.19:::::::* cpe:2.3:a:apache:http_server:1.3.19::win32::::: cpe:2.3:a:apache:http_server:1.3.18::win32::::: cpe:2.3:a:apache:http_server:1.3.18:::::::* cpe:2.3:a:apache:http_server:1.3.17:::::::* cpe:2.3:a:apache:http_server:1.3.17::win32::::: cpe:2.3:a:apache:http_server:1.3.16:::::::* cpe:2.3:a:apache:http_server:1.3.16::win32::::: cpe:2.3:a:apache:http_server:1.3.15::win32::::: cpe:2.3:a:apache:http_server:1.3.15:::::::* cpe:2.3:a:apache:http_server:1.3.14::mac_os::::: cpe:2.3:a:apache:http_server:1.3.14::win32::::: cpe:2.3:a:apache:http_server:1.3.14:::::::* cpe:2.3:a:apache:http_server:1.3.13::win32::::: cpe:2.3:a:apache:http_server:1.3.13:::::::* cpe:2.3:a:apache:http_server:1.3.12:::::::* cpe:2.3:a:apache:http_server:1.3.12::win32::::: cpe:2.3:a:apache:http_server:1.3.11::win32::::: cpe:2.3:a:apache:http_server:1.3.11:::::::* cpe:2.3:a:apache:http_server:1.3.10:::::::* cpe:2.3:a:apache:http_server:1.3.1.1:::::::* cpe:2.3:a:apache:http_server:1.3.1:::::::* cpe:2.3:a:apache:http_server:1.3.0:::::::* cpe:2.3:a:apache:http_server:1.3:::::::* cpe:2.3:a:apache:http_server:1.2.9:::::::* cpe:2.3:a:apache:http_server:1.2.6:::::::* cpe:2.3:a:apache:http_server:1.2.5:::::::* cpe:2.3:a:apache:http_server:1.2.4:::::::* cpe:2.3:a:apache:http_server:1.2.0:::::::* cpe:2.3:a:apache:http_server:1.1.1:::::::* cpe:2.3:a:apache:http_server:1.1:::::::* cpe:2.3:a:apache:http_server:1.0.5:::::::* cpe:2.3:a:apache:http_server:1.0.3:::::::* cpe:2.3:a:apache:http_server:1.0.2:::::::* cpe:2.3:a:apache:http_server:1.0:::::::* cpe:2.3:a:apache:http_server:0.8.14:::::::* cpe:2.3:a:apache:http_server:0.8.11:::::::* cpe:2.3:a:apache:http_server:::win32:::::* cpe:2.3:a:apache:http_server:::::::: cpe:2.3:a:apache:http_server:-:::::::*	67

OpenVAS Exploits

Date	Description
2008-09-24	Name : Gentoo Security Advisory GLSA 200405-22 (Apache) File : nvt/glsa_200405_22.nasl
0000-00-00	Name : Slackware Advisory SSA:2004-133-01 apache File : nvt/esoft_slk_ssa_2004_133_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
3819	Apache HTTP Server mod_digest Cross Realm Credential Replay Apache mod_digest contains a flaw that may allow a malicious user to conduct replay attack against a website using htdigest protection. The issue is triggered when sending the digest authentication credentials again to a different website. It is possible that the flaw may allow gain unauthorised access to other websites. resulting in a loss of confidentiality, integrity, and/or availability.

Description

3819

Apache HTTP Server mod_digest Cross Realm Credential Replay

Apache mod_digest contains a flaw that may allow a malicious user to conduct replay attack against a website using htdigest protection. The issue is triggered when sending the digest authentication credentials again to a different website. It is possible that the flaw may allow gain unauthorised access to other websites. resulting in a loss of confidentiality, integrity, and/or availability.

Nessus® Vulnerability Scanner

Date	Description
2005-07-13	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-133-01.nasl - Type : ACT_GATHER_INFO
2004-12-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-600.nasl - Type : ACT_GATHER_INFO
2004-12-02	Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20041202.nasl - Type : ACT_GATHER_INFO
2004-10-17	Name : The remote host is missing Sun Security Patch number 116973-07 File : solaris8_116973.nasl - Type : ACT_GATHER_INFO
2004-10-17	Name : The remote host is missing Sun Security Patch number 116974-07 File : solaris8_x86_116974.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200405-22.nasl - Type : ACT_GATHER_INFO
2004-07-31	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-046.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 113146-13 File : solaris9_113146.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 114145-12 File : solaris9_x86_114145.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote host is using an unsupported version of Mac OS X. File : macosx_version.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/9571
BUGTRAQ	http://marc.info/?l=bugtraq&m=108437852004207&w=2
GENTOO	http://security.gentoo.org/glsa/glsa-200405-22.xml
MANDRAKE	http://www.mandriva.com/security/advisories?name=MDKSA-2004:046
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2004-600.html http://www.redhat.com/support/errata/RHSA-2005-816.html
SECTRACK	http://securitytracker.com/id?1008920
SLACKWARE	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&...
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1
TRUSTIX	http://www.trustix.org/errata/2004/0027
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/15041

Alert History

If you want to see full details history, please login or register.

Date	Informations
2023-11-07 21:48:10	Multiple Updates
2023-08-12 12:02:48	Multiple Updates
2023-08-12 01:01:20	Multiple Updates
2023-08-11 12:02:23	Multiple Updates
2023-08-11 01:01:22	Multiple Updates
2023-08-06 12:02:12	Multiple Updates
2023-08-06 01:01:21	Multiple Updates
2023-08-04 12:02:16	Multiple Updates
2023-08-04 01:01:21	Multiple Updates
2023-07-14 12:02:15	Multiple Updates
2023-07-14 01:01:22	Multiple Updates
2023-03-29 01:02:16	Multiple Updates
2023-03-28 12:01:26	Multiple Updates
2021-06-06 17:23:04	Multiple Updates
2021-06-03 13:23:14	Multiple Updates
2021-05-04 12:02:09	Multiple Updates
2021-04-22 01:02:22	Multiple Updates
2021-03-30 17:22:46	Multiple Updates
2020-05-24 01:01:29	Multiple Updates
2020-05-23 00:15:33	Multiple Updates
2017-10-11 09:23:19	Multiple Updates
2017-07-11 12:01:19	Multiple Updates
2016-10-18 12:01:14	Multiple Updates
2016-10-08 01:00:37	Multiple Updates
2016-04-26 12:39:06	Multiple Updates
2014-02-17 10:26:44	Multiple Updates
2013-05-11 11:53:22	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	2
CPE ID(s)	67
Sources(s)	25
osvdb(s)	1
Openvas Exploit(s)	2
Nessus® Exploit(s)	10

	Related
7.5	RHSA-2004:600
7.5	CVE-2021-31618
5.5	CVE-2020-13938
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)

7.5 - CVE-2003-0987

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU