Apache version up to 1.3.33 htpasswd local overflow
Apache version up to 1.3.33 htpasswd local overflow
Published on 2005-10-03. Updated on 2007-03-20.
Description:
This alert was generated using only banner information. It may be a false positive.
A buffer overflow vulnerability exists in the htpasswd utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied 'user' data into local buffers.
Affected Apache versions (up to 1.3.33).
Impact:
Since the program is not setuid, this vulnerability does not have a local impact. However, this may be an issue if the software is called from a CGI script. An attacker may be able to supply malformed data to the program which will cause the overflow to occur.
Recommendation:
Make sure htpasswd does not run setuid and is not accessible through any CGI scripts.
Alert Tags: configuration
ApplicableApplicationServer : All
ApplicableOS: All
ApplicableWebServer: Apache
References:
Go Back