CVE-2001-1449: High severity Apache HTTP Server vulnerability

Published Nov 28, 2001

Updated

The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.

Affected Software

16 affected components

Apache HTTP Server=1.3

Apache HTTP Server=1.3.1

Apache HTTP Server=1.3.3

Apache HTTP Server=1.3.4

Apache HTTP Server=1.3.6

Apache HTTP Server=1.3.9

Apache HTTP Server=1.3.11

Apache HTTP Server=1.3.12

Apache HTTP Server=1.3.14

Apache HTTP Server=1.3.17

Apache HTTP Server=1.3.18

Mandrakesoft Mandrake Single Network Firewall=7.2

Mandrakesoft Mandrake Linux=7.1

Mandrakesoft Mandrake Linux=7.3

Mandrakesoft Mandrake Linux=8.0

Mandrakesoft Mandrake Linux Corporate Server=1.0.1

Remediation

Patch Available

http://www.kb.cert.org/vuls/id/913704

Event History

Nov 28, 2001

CVE Published

05:00 AM

Apr 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1449?

The severity of CVE-2001-1449 is classified as medium, given that it allows remote attackers to list directory contents.

How do I fix CVE-2001-1449?

To fix CVE-2001-1449, update Apache HTTP Server to version 1.3.19 or later or configure appropriate directory settings to prevent directory listing.

What systems are affected by CVE-2001-1449?

CVE-2001-1449 affects Apache HTTP Server versions 1.3.1 through 1.3.18 and specific versions of Mandrake Linux.

Can CVE-2001-1449 be exploited remotely?

Yes, CVE-2001-1449 can be exploited remotely by attackers to gain access to web directory listings without proper authorization.

Is CVE-2001-1449 still a concern today?

While CVE-2001-1449 primarily impacts older systems, organizations running unsupported versions of Apache should consider it a security concern.