CVE-2000-0208: Medium severity htdig htdig vulnerability
The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks () in parameters to htsearch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ht://Digfrom your environment.Uninstall htdig (ht://Dig) from affected systems or remove its CGI programs if the software is not required.
- Configuration
Disable or remove the htsearch CGI script (htsearch) from the webserver to prevent remote exploitation that allows arbitrary file reads.
ht://Dig htsearch CGI enabled = false - Compensating control
Restrict access to the htsearch CGI (and other htdig endpoints) using the web server or network firewall (allow only trusted IPs) or configure the web server to block/return 403 for htsearch requests until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0208?
CVE-2000-0208 is classified as a security vulnerability that allows remote file access, potentially leading to information disclosure.
How do I fix CVE-2000-0208?
To fix CVE-2000-0208, upgrade to a patched version of ht://Dig that addresses the arbitrary file read issue.
What software versions are affected by CVE-2000-0208?
CVE-2000-0208 affects ht://Dig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4, and 3.2.0b1.
What type of attack does CVE-2000-0208 enable?
CVE-2000-0208 enables remote attackers to read arbitrary files from the server by exploiting the htsearch CGI program.
What is the origin of CVE-2000-0208?
CVE-2000-0208 was reported in the ht://Dig CGI program specifically related to how it handles parameters in the htsearch function.