ID CVE-2000-0913
Summary mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
References
Vulnerable Configurations
  • Apache Software Foundation Apache HTTP Server 0.8.11
    cpe:2.3:a:apache:http_server:0.8.11
  • Apache Software Foundation Apache HTTP Server 0.8.14
    cpe:2.3:a:apache:http_server:0.8.14
  • Apache Software Foundation Apache HTTP Server 1.0
    cpe:2.3:a:apache:http_server:1.0
  • Apache Software Foundation Apache HTTP Server 1.0.2
    cpe:2.3:a:apache:http_server:1.0.2
  • Apache Software Foundation Apache HTTP Server 1.0.3
    cpe:2.3:a:apache:http_server:1.0.3
  • Apache Software Foundation Apache HTTP Server 1.0.5
    cpe:2.3:a:apache:http_server:1.0.5
  • Apache Software Foundation Apache HTTP Server 1.1
    cpe:2.3:a:apache:http_server:1.1
  • Apache Software Foundation Apache HTTP Server 1.1.1
    cpe:2.3:a:apache:http_server:1.1.1
  • cpe:2.3:a:apache:http_server:1.3.11:-:win32
    cpe:2.3:a:apache:http_server:1.3.11:-:win32
  • Apache Software Foundation Apache HTTP Server 1.3.12
    cpe:2.3:a:apache:http_server:1.3.12
CVSS
Base: 5.0 (as of 01-01-2004 - 00:00)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
NASL family Mandriva Local Security Checks
NASL id MANDRAKE_MDKSA-2000-060.NASL
description The Apache web server comes with a module called mod_rewrite which is used to rewrite URLs presented by the client prior to further processing. There is a flaw in the mod_rewrite logic that allows an attacker to view arbitrary files on the server system if they contain regular expression references. All Linux-Mandrake users using Apache are encouraged to upgrade to these updated versions that fix this flaw. The Apache package for 7.1 had a problem with improper permissions on the suexec wrapper which prevented it from running if the apache-suexec package was installed. As well, the uninstall script would exit with errors. Both issues are fixed. The new md5 checksums are listed below. Update : The permissions on the -14mdk apache-suexec package were still incorrect. While some CGI scripts would perform, others would not due to the permissions being 4700 and not 4711. The -15mdk RPMs for 7.1 fix this issue.
last seen 2019-02-21
modified 2018-07-19
plugin id 61847
published 2012-09-06
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=61847
title Mandrake Linux Security Advisory : apache (MDKSA-2000:060-2)
redhat via4
advisories
  • rhsa
    id RHSA-2000:088
  • rhsa
    id RHSA-2000:095
refmap via4
bid 1728
bugtraq
  • 20000929 Security vulnerability in Apache mod_rewrite
  • 20001011 Conectiva Linux Security Announcement - apache
caldera CSSA-2000-035.0
hp HPSBUX0010-126
mandrake MDKSA-2000:060
xf apache-rewrite-view-files(5310)
statements via4
contributor Mark J Cox
lastmodified 2008-07-02
organization Apache
statement Fixed in Apache HTTP Server 1.3.14: http://httpd.apache.org/security/vulnerabilities_13.html
Last major update 05-09-2008 - 16:22
Published 19-12-2000 - 00:00
Last modified 09-10-2017 - 21:29
Back to Top