ID CVE-2003-1418
Summary Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).
References
Vulnerable Configurations
  • Apache Software Foundation Apache HTTP Server 1.3.22
    cpe:2.3:a:apache:http_server:1.3.22
  • Apache Software Foundation Apache HTTP Server 1.3.23
    cpe:2.3:a:apache:http_server:1.3.23
  • Apache Software Foundation Apache HTTP Server 1.3.24
    cpe:2.3:a:apache:http_server:1.3.24
  • Apache Software Foundation Apache HTTP Server 1.3.25
    cpe:2.3:a:apache:http_server:1.3.25
  • Apache Software Foundation Apache HTTP Server 1.3.26
    cpe:2.3:a:apache:http_server:1.3.26
  • Apache Software Foundation Apache HTTP Server 1.3.27
    cpe:2.3:a:apache:http_server:1.3.27
CVSS
Base: 4.3 (as of 06-12-2007 - 20:54)
Impact:
Exploitability:
CWE CWE-200
CAPEC
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
  • Reusing Session IDs (aka Session Replay)
    This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
  • Using Slashes in Alternate Encoding
    This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Web Servers
    NASL id ORACLE_HTTP_SERVER_CPU_OCT_2015.NASL
    description The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities : - (CVE-2003-1418) - A denial of service vulnerability exists in libxml2, related to the xmlParserHandlePEReference() function in file parser.c, due to loading external parameter entities without regard to entity substitution or validation being enabled, as in the case of entity substitution in the doctype prolog. An unauthenticated, remote attacker can exploit this, via specially crafted XML content, to exhaust the system CPU, memory, or file descriptor resources. (CVE-2014-0191) - An unspecified vulnerability exists in the Web Listener component that allows an unauthenticated, remote attacker to impact availability. (CVE-2015-1829) - (CVE-2015-2808) - An unspecified vulnerability exists in the OSSL Module that allows an unauthenticated, remote attacker to impact confidentiality. (CVE-2015-4812) - An unspecified vulnerability exists in the Web Listener component that allows an authenticated, remote attacker to impact confidentiality. (CVE-2015-4914) - (CVE-2016-2183)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 86569
    published 2015-10-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86569
    title Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (October 2015 CPU)
  • NASL family Web Servers
    NASL id ORACLE_HTTP_SERVER_CPU_JAN_2015.NASL
    description The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities in the Web Listener subcomponent : - An integer overflow condition exists in libxml2 within file xpath.c, related to XPath expressions when adding a new namespace note. An unauthenticated, remote attacker can exploit this, via a crafted XML file, to cause a denial of service condition or the execution of arbitary code. (CVE-2011-1944) - An integer overflow condition exists in the HTTP server, specifically in the ap_pregsub() function within file server/util.c, when the mod_setenvif module is enabled. A local attacker can exploit this to gain elevated privileges by using an .htaccess file with a crafted combination of SetEnvIf directives and HTTP request headers. (CVE-2011-3607) - A flaw exists in libxml2, known as the 'internal entity expansion' with linear complexity issue, that allows specially crafted XML files to consume excessive CPU and memory resources. An unauthenticated, remote attacker can exploit this to cause a denial of service condition by using a specially crafted XML file containing an entity declaration with long replacement text and many references to this entity. (CVE-2013-0338) - An out-of-bounds read error exists in libxml2 within file parser.c due to a failure to check for the XML_PARSER_EOF state. An unauthenticated, remote attacker can exploit this, via a specially crafted document that ends abruptly, to cause a denial of service condition. (CVE-2013-2877) - A flaw exists within the mod_headers module in the HTTP server which allows bypassing the 'RequestHeader unset' directives. An unauthenticated, remote attacker can exploit this to inject arbitrary headers. This is done by placing a header in the trailer portion of data being sent using chunked transfer encoding. (CVE-2013-5704) - A flaw exists in the dav_xml_get_cdata() function in file main/util.c within the HTTP server mod_dav module due to incorrect stripping of whitespace characters from the CDATA sections. An unauthenticated, remote attacker via a specially crafted DAV WRITE request, can exploit this to cause a denial of service condition. (CVE-2013-6438) - A flaw exists in the log_cookie() function in file mod_log_config.c within the HTTP server mod_log_config module due to improper handling of specially crafted cookies during truncation. An unauthenticated, remote attacker can exploit this to cause a denial of service condition via a segmentation fault. (CVE-2014-0098) - A flaw exists in libxml2, specifically in the xmlParserHandlePEReference() function in file parser.c, due to loading external parameter entities even when entity substitution is disabled. An unauthenticated, remote attacker can exploit this issue, via a specially crafted XML file, to conduct XML External Entity (XXE) attacks that exhaust CPU and memory resources, resulting in a denial of service condition. (CVE-2014-0191) - A race condition exists in the HTTP server within the mod_status module when using a threaded Multi-Processing Module (MPM). If an unauthenticated, remote attacker is able to access status pages served by mod_status, the attacker can exploit this issue, by sending specially crafted requests, to cause the httpd child process to crash or possibly execute arbitrary code with the privileges of the user running the web server. (CVE-2014-0226) - An unspecified flaw exists in the Web Listener subcomponent that allows an unauthenticated, remote attacker to impact confidentiality, integrity, and availability. (CVE-2014-6571) - An unspecified flaw exists in the J2EE subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information. (CVE-2015-0372) - An unspecified flaw exists in the Web Listener subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2015-0386)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81002
    published 2015-01-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81002
    title Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2015 CPU)
  • NASL family Web Servers
    NASL id APACHE_ETAG_INFO_DISCLOSURE.NASL
    description The remote web server is affected by an information disclosure vulnerability due to the ETag header providing sensitive information that could aid an attacker, such as the inode number of requested files.
    last seen 2019-02-21
    modified 2018-09-17
    plugin id 88098
    published 2016-01-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=88098
    title Apache Server ETag Header Information Disclosure
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_APACHE2-150325.NASL
    description The Apache2 webserver was updated to fix various issues. The following feature was added : - Provide support for the tunneling of web socket connections to a backend websockets server. (FATE#316880) The following security issues have been fixed : - The mod_headers module in the Apache HTTP Server 2.2.22 allowed remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. The fix also adds a 'MergeTrailers' directive to restore legacy behavior. (CVE-2013-5704) - The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header. (CVE-2014-3581) - Apache HTTP Server allowed remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID). We so far assumed that this not useful to attackers, the fix is basically just reducing potential information leaks. (CVE-2003-1418) The following bugs have been fixed : - Treat the 'server unavailable' condition as a transient error with all LDAP SDKs. (bsc#904427) - Fixed a segmentation fault at startup if the certs are shared across > 1 server_rec. (bsc#907339)
    last seen 2019-02-21
    modified 2015-07-26
    plugin id 82657
    published 2015-04-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82657
    title SuSE 11.3 Security Update : apache2 (SAT Patch Number 10533)
  • NASL family Web Servers
    NASL id ORACLE_HTTP_SERVER_CPU_JUL_2016.NASL
    description The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as noted in the July 2016 CPU advisory.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 92542
    published 2016-07-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92542
    title Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (July 2016 CPU)
refmap via4
bid
  • 6939
  • 6943
confirm http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
openbsd [3.2] 008: SECURITY FIX: February 25, 2003
xf apache-mime-information-disclosure(11438)
Last major update 05-09-2008 - 16:36
Published 31-12-2003 - 00:00
Last modified 19-10-2017 - 21:29
Back to Top