CVE-2001-0834: Medium severity htdig htdig vulnerability
htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2001-0834?
CVE-2001-0834 has a moderate severity level as it can lead to denial of service and unauthorized file access.
How do I fix CVE-2001-0834?
To fix CVE-2001-0834, upgrade the htdig software to version 3.1.6 or later, or implement proper access controls.
What types of attacks can CVE-2001-0834 facilitate?
CVE-2001-0834 can facilitate denial of service attacks and unauthorized file reading due to the ability to specify alternate configuration files.
Which software versions are affected by CVE-2001-0834?
CVE-2001-0834 affects htdig versions up to and including 3.1.5, as well as several Conectiva Linux and SUSE Linux versions.
Is CVE-2001-0834 still a concern today?
While CVE-2001-0834 is dated, it remains a concern for systems running vulnerable versions of the affected software that have not been updated.