CVE-2000-0505: Medium severity Apache HTTP Server vulnerability
The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable automatic directory listings in the server configuration (e.g., add 'Options -Indexes' for the relevant <Directory> sections or in httpd.conf) to prevent remote listing of directory contents.
Apache HTTP Server (1.3.x) and IBM HTTP Server on Windows Options (directory listing) = disable (Options -Indexes) - Compensating control
Deploy perimeter filtering (WAF/firewall) to block or normalize requests containing abnormally long sequences of '/' characters, and/or restrict access to the HTTP server to trusted IP ranges until a vendor fix is available.
- Operational
Review web server access logs for requests containing large numbers of '/' characters, investigate and block offending source IPs, and continue monitoring for signs of attempted exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0505?
CVE-2000-0505 is classified as a medium severity vulnerability.
How do I fix CVE-2000-0505?
To fix CVE-2000-0505, you should upgrade to a patched version of Apache HTTP Server or configure security settings to disable directory listing.
What are the affected versions in CVE-2000-0505?
CVE-2000-0505 affects Apache HTTP Server versions 1.3.3 to 1.3.12 and IBM HTTP Server versions 1.3.3 and 1.3.6.2.
What kind of attack does CVE-2000-0505 allow?
CVE-2000-0505 allows remote attackers to list directory contents, exposing sensitive information.
On which operating system is CVE-2000-0505 applicable?
CVE-2000-0505 is applicable to the Windows platforms running the specified versions of Apache and IBM HTTP Server.