Executive Summary
Summary | |
---|---|
Title | New versions of apache, fixes index bug |
Informations | |||
---|---|---|---|
Name | DSA-067 | First vendor Publication | 2001-07-28 |
Vendor | Debian | Last vendor Modification | 2001-07-28 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
We have received reports that the 'apache' http daemon, as included in the Debian 'stable' distribution, is vulnerable to the 'artificially long slash path directory listing vulnerability' as described in http://www.securityfocus.com/vdb/bottom.html?vid=2503 . This vulnerability was announced to bugtraq by Dan Harkless. Quoting the SecurityFocus entry for this vulnerability: A problem in the package could allow directory indexing, and path discovery. In a default configuration, Apache enables mod_dir, mod_autoindex, and mod_negotiation. However, by placing a custom crafted request to the Apache server consisting of a long path name created artificially by using numerous slashes, this can cause these modules to misbehave, making it possible to escape the error page, and gain a listing of the directory contents. This vulnerability makes it possible for a malicious remote user to launch an information gathering attack, which could potentially result in compromise of the system. Additionally, this vulnerability affects all releases of Apache previous to 1.3.19. This problem has been fixed in apache-ssl 1.3.9-13.3 and apache_1.3.9-14. We recommend that you upgrade your packages immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.2 alias potato - |
Original Source
Url : http://www.debian.org/security/2001/dsa-067 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 4 | |
Os | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2008-01-17 | Name : Debian Security Advisory DSA 067-1 (apache,apache-ssl) File : nvt/deb_067_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
9700 | Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing Apache HTTP server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a specially crafted request, consisting of a large amount of slash characters '/', to a default apache install. The default enabled mod_autoindex module will disclose a directory listing of the root directory instead of the index.html, resulting in a loss of confidentiality. |
9699 | Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing Apache HTTP server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a specially crafted request, consisting of a large amount of slash characters '/', to a default apache install. The default enabled mod_dir module will disclose a directory listing of the root directory instead of the index.html, resulting in a loss of confidentiality. |
9698 | Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Li... Apache HTTP server contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered when a remote attacker sends a specially crafted request, consisting of a large amount of slash characters '/', to a default apache install. The default enabled mod_negotiation, mod_dir/mod_autoindex modules will disclose a directory listing of the root directory instead of the index.html, resulting in a loss of confidentiality. |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | apache directory disclosure attempt RuleID : 1156-community - Revision : 17 - Type : SERVER-WEBAPP |
2014-01-10 | apache directory disclosure attempt RuleID : 1156 - Revision : 17 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-067.nasl - Type : ACT_GATHER_INFO |
2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2001-077.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:25:26 |
|