DSA-021-1 apache -- insecure tempfile bug, broken mod_rewrite

Debian Security Advisory

DSA-021-1 apache -- insecure tempfile bug, broken mod_rewrite

Date Reported:

26 Jan 2001

Affected Packages:

apache

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 2182.
In Mitre's CVE dictionary: CVE-2001-0131.

More information:

WireX have found some occurrences of insecure opening of temporary files in htdigest and htpasswd. Both programs are not installed setuid or setgid and thus the impact should be minimal. The Apache group has released another security bugfix which fixes a vulnerability in mod_rewrite which may result the remote attacker to access arbitrary files on the web server.

Fixed in:

Debian 2.2 (potato)

Source:

http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9-13.2.diff.gz

http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9-13.2.dsc

http://security.debian.org/dists/stable/updates/main/source/apache_1.3.9.orig.tar.gz

alpha:

http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-common_1.3.9-13.2_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/apache-dev_1.3.9-13.2_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/apache_1.3.9-13.2_alpha.deb

arm:

http://security.debian.org/dists/stable/updates/main/binary-arm/apache-common_1.3.9-13.2_arm.deb

http://security.debian.org/dists/stable/updates/main/binary-arm/apache-dev_1.3.9-13.2_arm.deb

http://security.debian.org/dists/stable/updates/main/binary-arm/apache_1.3.9-13.2_arm.deb

i386:

http://security.debian.org/dists/stable/updates/main/binary-i386/apache-common_1.3.9-13.2_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/apache-dev_1.3.9-13.2_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/apache_1.3.9-13.2_i386.deb

m68k:

http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-common_1.3.9-13.2_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/apache-dev_1.3.9-13.2_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/apache_1.3.9-13.2_m68k.deb

powerpc:

http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-common_1.3.9-13.2_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache-dev_1.3.9-13.2_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/apache_1.3.9-13.2_powerpc.deb

sparc:

http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-common_1.3.9-13.2_sparc.deb

http://security.debian.org/dists/stable/updates/main/binary-sparc/apache-dev_1.3.9-13.2_sparc.deb

http://security.debian.org/dists/stable/updates/main/binary-sparc/apache_1.3.9-13.2_sparc.deb