CVE

Id
5617  
CVE No.
CVE-2002-1233  
Status
Candidate  
Description
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.  
Phase
Modified (20050529)  
Votes
ACCEPT(3) Armstrong, Cole, Green | NOOP(1) Cox  
Comments
Cox> Many vendors have included fixes for CVE-2001-0131 in their distributions | of Apache even though this has not been fixed upstream. I still believe | that this is not worthy of a separate CVE name since this is just Debian | forgetting to include their fix for CVE-2001-0131 in one of their versions, | and then correcting it.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
30852 5617 CVE-2002-1233 BUGTRAQ:20021016 Apache 1.3.26  View
30853 5617 CVE-2002-1233 URL:http://marc.info/?l=bugtraq&m=103480856102007&w=2  View
30854 5617 CVE-2002-1233 DEBIAN:DSA-187  View
30855 5617 CVE-2002-1233 URL:http://www.debian.org/security/2002/dsa-187  View
30856 5617 CVE-2002-1233 DEBIAN:DSA-188  View
30857 5617 CVE-2002-1233 URL:http://www.debian.org/security/2002/dsa-188  View
30858 5617 CVE-2002-1233 DEBIAN:DSA-195  View
30859 5617 CVE-2002-1233 URL:http://www.debian.org/security/2002/dsa-195  View
30860 5617 CVE-2002-1233 BID:5981  View
30861 5617 CVE-2002-1233 URL:http://www.securityfocus.com/bid/5981  View
30862 5617 CVE-2002-1233 BID:5990  View
30863 5617 CVE-2002-1233 URL:http://www.securityfocus.com/bid/5990  View
30864 5617 CVE-2002-1233 XF:apache-htpasswd-tmpfile-race(10412)  View
30865 5617 CVE-2002-1233 URL:http://www.iss.net/security_center/static/10412.php  View
30866 5617 CVE-2002-1233 XF:apache-htdigest-tmpfile-race(10413)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63924 JVNDB-2002-000251 Apache HTTP Server の Htdigest および Htpasswd における不適切な一時ファイル作成の脆弱性 Apache HTTP Server に含まれている htdigest および htpasswd には、一時ファイルの作成に問題があり、これらのユーティリティにより作成した認証用データファイルに対して、競合状態を利用したシンボリックリンク攻撃を受ける脆弱性が存在します。 CVE-2002-1233 5617 2.6 http://jvndb.jvn.jp/ja/contents/2002/JVNDB-2002-000251.html  View