CVE-2005-1344
published 2005-05-02CVE-2005-1344: Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only…
PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
29.10%
98.0th percentile
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| debian | apache2 | < apache2 2.0.54-3 (bookworm) | apache2 2.0.54-3 (bookworm) |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p8pw-2w2f-8jr7: Buffer overflow in htdigest in Apache 2
ghsa_unreviewed·2022-05-01
CVE-2005-1344 [HIGH] GHSA-p8pw-2w2f-8jr7: Buffer overflow in htdigest in Apache 2
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
OSV
CVE-2005-1344: Buffer overflow in htdigest in Apache 2
osv·2005-05-02·CVSS 7.5
CVE-2005-1344 [HIGH] CVE-2005-1344: Buffer overflow in htdigest in Apache 2
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Ubuntu
Apache 2 vulnerability
vendor_ubuntu·2005-05-06
CVE-2005-1344 Apache 2 vulnerability
Title: Apache 2 vulnerability
Summary: Apache 2 vulnerability
Luca Ercoli discovered that the "htdigest" program did not perform any
bounds checking when it copied the "user" and "realm" arguments into
local buffers. If this program is used in remotely callable CGI
scripts, this could be exploited by a remote attacker to execute
arbitrary code with the privileges of the CGI script.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2005-1344: apache2 - Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbi...
vendor_debian·2005·CVSS 7.5
CVE-2005-1344 [HIGH] CVE-2005-1344: apache2 - Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbi...
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Scope: local
bookworm: resolved (fixed in 2.0.54-3)
bullseye: resolved (fixed in 2.0.54-3)
forky: resolved (fixed in 2.0.54-3)
sid: resolved (fixed in 2.0.54-3)
trixie: resolved (fixed in 2.0.54-3)
Red Hat
CVE-2005-1344: Buffer overflow in htdigest in Apache 2
vendor_redhat·CVSS 7.5
CVE-2005-1344 [HIGH] CVE-2005-1344: Buffer overflow in htdigest in Apache 2
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Statement: Red Hat does not consider this to be a vulnerability. htdigest is not supplied setuid or setgid and should not be run from a CGI program.
No detection rules found.
Exploit-DB
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (2)
exploitdb·2005-05-11
CVE-2005-1344 Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (2)
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (2)
---
// source: https://www.securityfocus.com/bid/13537/info
A buffer overflow vulnerability exists in the htdigest utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers.
By supplying an overly long realm value to the command line options of htdigest, it is possible to trigger an overflow condition. This may cause memory to be corrupted with attacker-specified values.
This issue could be exploited by a remote attacker; potentially resulting in the execution of arbitrary system commands within the context of the web server process.
/*
* htdigest-realm-bof.c by K-sPecial 5-11-2005 { irc://irc.xzziroz.net }
*
* exploit for htdigest
Exploit-DB
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)
exploitdb·2005-05-06
CVE-2005-1344 Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)
---
// source: https://www.securityfocus.com/bid/13537/info
A buffer overflow vulnerability exists in the htdigest utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers.
By supplying an overly long realm value to the command line options of htdigest, it is possible to trigger an overflow condition. This may cause memory to be corrupted with attacker-specified values.
This issue could be exploited by a remote attacker; potentially resulting in the execution of arbitrary system commands within the context of the web server process.
#include
#include
#include
/***********************************************************************
http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2005/Aug/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2005/May/msg00001.htmlhttp://www.lucaercoli.it/advs/htdigest.txthttp://www.osvdb.org/12848http://www.securiteam.com/unixfocus/5EP061FEKC.htmlhttp://www.securityfocus.com/bid/13537http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2005/Aug/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2005/May/msg00001.htmlhttp://www.lucaercoli.it/advs/htdigest.txthttp://www.osvdb.org/12848http://www.securiteam.com/unixfocus/5EP061FEKC.htmlhttp://www.securityfocus.com/bid/13537
2005-05-02
Published