medium5.0Public exploit code
CVE-2001-0925
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache 1.3 - Artificially Long Slash Path Directory Listing (4)2001-06-13 · remote · multiple · Verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (3)2001-06-13 · remote · multiple · Verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (2)2002-02-21 · remote · multiple · Verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (1)2001-06-13 · remote · multiple · Verified
Impact
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Http Server | Versions 1.3.11, 1.3.12, 1.3.14, 1.3.17 |
| Debian | Debian Linux | Version 2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.apacheweek.com/features/security-13
- http://www.debian.org/security/2001/dsa-067
- http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3
- http://www.linuxsecurity.com/advisories/other_advisory-1452.html
- http://www.securityfocus.com/archive/1/168497
- http://www.securityfocus.com/archive/1/178066
- http://www.securityfocus.com/archive/1/193081
- http://www.securityfocus.com/bid/2503
- http://www.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-01-27&end=2002-02-02&mid=199857&threads=1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6921
- https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- http://www.apacheweek.com/features/security-13
- http://www.debian.org/security/2001/dsa-067
- http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3
- http://www.linuxsecurity.com/advisories/other_advisory-1452.html
- http://www.securityfocus.com/archive/1/168497
- http://www.securityfocus.com/archive/1/178066
- http://www.securityfocus.com/archive/1/193081
- http://www.securityfocus.com/bid/2503
- http://www.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-01-27&end=2002-02-02&mid=199857&threads=1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6921
- https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E