Apache Http Server vulnerabilities

CVE-2002-0839 [HIGH] CVE-2002-0839: The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user runni The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

CVE-2003-0134 [MEDIUM] CVE-2003-0134: Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows u Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.

CVE-2003-0192 [MEDIUM] CVE-2003-0192: Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "cert Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.

CVE-2004-2343 [HIGH] CVE-2004-2343: Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as s Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privilege

CVE-2003-1418 [MEDIUM] CWE-200 CVE-2003-1418: Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive info Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).

CVE-2009-3094 [LOW] CWE-476 CVE-2009-3094: The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Ap The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.

CVE-2007-6422 [MEDIUM] CWE-399 CVE-2007-6422: The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, w The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.

CVE-2007-1743 [MEDIUM] CVE-2007-1743: suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on a

CVE-2007-6421 [LOW] CWE-79 CVE-2007-6421: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTT Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.

CVE-2001-1556 [MEDIUM] CWE-532 CVE-2001-1556: The log files in Apache web server contain information directly supplied by clients and does not fil The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.

CVE-2004-0263 [MEDIUM] CVE-2004-0263: PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual host PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.

CVE-2002-0249 [MEDIUM] CVE-2002-0249: PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote atta PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.

CVE-2002-1592 [MEDIUM] CVE-2002-1592: The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.

CVE-2002-0240 [MEDIUM] CVE-2002-0240: PHP, when installed with Apache and configured to search for index.php as a default web page, allows PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.

CVE-2004-1834 [LOW] CVE-2004-1834: mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication informat mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.

CVE-2002-1658 [MEDIUM] CVE-2002-1658: Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary cod Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not b

CVE-2007-3303 [MEDIUM] CWE-94 CVE-2007-3303: Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large numb

CVE-2001-0131 [LOW] CWE-59 CVE-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.

CVE-2003-1581 [LOW] CWE-79 CVE-2003-1581: The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

CVE-2007-1742 [LOW] CVE-2007-1742: suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the curre suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that