CVE-2002-1658: Buffer Overflow

Published Dec 31, 2002

Updated

Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.

Affected Software

18 affected components

Apache HTTP Server=1.3.23

Apache HTTP Server=1.3.27

Apache HTTP Server=1.3.1

Apache HTTP Server=1.3.25

Apache HTTP Server=1.3.19

Apache HTTP Server=1.3.24

Apache HTTP Server=1.3.20

Apache HTTP Server=1.3.6

Apache HTTP Server=1.3.4

Apache HTTP Server=1.3.18

Apache HTTP Server=1.3.12

Apache HTTP Server=1.3.3

Apache HTTP Server=1.3.17

Apache HTTP Server=1.3.26

Apache HTTP Server=1.3.9

Apache HTTP Server=1.3.14

Apache HTTP Server=1.3.22

Apache HTTP Server=1.3.11

Event History

Dec 31, 2002

CVE Published

05:00 AM

Apr 27, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1658?

CVE-2002-1658 has a medium severity level due to the potential for attackers to execute arbitrary code.

How do I fix CVE-2002-1658?

To fix CVE-2002-1658, you should upgrade your Apache HTTP Server to a version later than 1.3.27.

What software versions are affected by CVE-2002-1658?

CVE-2002-1658 affects Apache HTTP Server versions 1.3.1 through 1.3.27.

What type of attack can exploit CVE-2002-1658?

CVE-2002-1658 can be exploited through a buffer overflow attack via a long user argument to the htdigest tool.

Is CVE-2002-1658 a remotely exploitable vulnerability?

CVE-2002-1658 is typically not remotely exploitable as htdigest is usually only accessible locally.