7.5
CVSSv2

CVE-2005-1344

Published: 02/05/2005 Updated: 10/09/2008
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 760
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Buffer overflow in htdigest in Apache 2.0.52 may allow malicious users to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server 2.0.52

Vendor Advisories

Luca Ercoli discovered that the “htdigest” program did not perform any bounds checking when it copied the “user” and “realm” arguments into local buffers If this program is used in remotely callable CGI scripts, this could be exploited by a remote attacker to execute arbitrary code with the privileges of the CGI script ...

Exploits

source: wwwsecurityfocuscom/bid/13537/info A buffer overflow vulnerability exists in the htdigest utility included with Apache The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers By supplying an overly long realm value to the command line options of htdigest, it is possible to ...
source: wwwsecurityfocuscom/bid/13537/info A buffer overflow vulnerability exists in the htdigest utility included with Apache The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers By supplying an overly long realm value to the command line options of htdigest, it is possible to t ...