Debian Security Advisory

DSA-021-1 apache -- insecure tempfile bug, broken mod_rewrite

Date Reported:

26 Jan 2001

Affected Packages:

apache

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 2182.
In Mitre's CVE dictionary: CVE-2001-0131.

More information:

WireX have found some occurrences of insecure opening of temporary files in htdigest and htpasswd. Both programs are not installed setuid or setgid and thus the impact should be minimal. The Apache group has released another security bugfix which fixes a vulnerability in mod_rewrite which may result the remote attacker to access arbitrary files on the web server.

Fixed in:

Debian 2.2 (potato)

Source:: http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9-13.2.diff.gz; http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9-13.2.dsc; http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9.orig.tar.gz
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-common_1.3.9-13.2_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-dev_1.3.9-13.2_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/apache_1.3.9-13.2_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/apache-common_1.3.9-13.2_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/apache-dev_1.3.9-13.2_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/apache_1.3.9-13.2_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/apache-common_1.3.9-13.2_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/apache-dev_1.3.9-13.2_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/apache_1.3.9-13.2_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-common_1.3.9-13.2_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-dev_1.3.9-13.2_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/apache_1.3.9-13.2_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-common_1.3.9-13.2_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-dev_1.3.9-13.2_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache_1.3.9-13.2_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-common_1.3.9-13.2_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-dev_1.3.9-13.2_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/apache_1.3.9-13.2_sparc.deb