Apache Error Log Escape Sequence Injection Vulnerability
Apache Error Log Escape Sequence Injection Vulnerability
Published on 2004-03-27. Updated on 2007-03-20.
Description:
This alert was generated using only banner information. It may be a false positive.
This version of Apache is vulnerable to escape character sequences injection into error log.This problem may be exploited when a vulnerable terminal emulator is used.
Affected Apache versions (up to 2.0.48 for Apache 2.x and up to 1.3.29 for Apache 1.x).
Impact:
Possible file creation and/or code execution (if vulnerable terminal emulator is present)
Recommendation:
Upgrade to the latest version of Apache.
Alert Tags: configuration
ApplicableApplicationServer : All
ApplicableOS: All
ApplicableWebServer: Apache
References:
Go Back