CVE-2002-2029: High severity Apache HTTP Server vulnerability
PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or change the Apache ScriptAlias that maps /php/ to c:/php/ (i.e., do not set ScriptAlias /php/ to c:/php/). This prevents direct HTTP requests to php.exe with a filename in the query string.
Apache Http Server ScriptAlias /php/ = do not set to c:/php/ (remove mapping)
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2029?
CVE-2002-2029 is considered a critical vulnerability due to its ability to allow remote file access and possible arbitrary code execution.
How do I fix CVE-2002-2029?
To fix CVE-2002-2029, you should upgrade to a non-vulnerable version of the Apache HTTP Server and ensure it is configured securely.
What systems are affected by CVE-2002-2029?
CVE-2002-2029 affects specific versions of Apache HTTP Server when installed on Windows with certain configurations.
What can attackers do with CVE-2002-2029?
Attackers can exploit CVE-2002-2029 to read arbitrary files and execute programs on vulnerable installations.
Is CVE-2002-2029 still a risk today?
CVE-2002-2029 remains a risk for any systems still running the affected versions of Apache HTTP Server without necessary updates.