CVE-2003-0993: High severity Apache HTTP Server vulnerability

Published Mar 29, 2004

Updated

modaccess in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

Affected Software

22 affected components

Apache HTTP Server=1.3

Apache HTTP Server=1.3.1

Apache HTTP Server=1.3.3

Apache HTTP Server=1.3.4

Apache HTTP Server=1.3.6

Apache HTTP Server=1.3.7

Apache HTTP Server=1.3.9

Apache HTTP Server=1.3.11

Apache HTTP Server=1.3.12

Apache HTTP Server=1.3.14

Apache HTTP Server=1.3.17

Apache HTTP Server=1.3.18

Apache HTTP Server=1.3.19

Apache HTTP Server=1.3.20

Apache HTTP Server=1.3.22

Apache HTTP Server=1.3.23

Apache HTTP Server=1.3.24

Apache HTTP Server=1.3.25

Apache HTTP Server=1.3.26

Apache HTTP Server=1.3.27

Apache HTTP Server=1.3.28

Apache HTTP Server=1.3.29

Remediation

Patch Available

http://www.securityfocus.com/bid/9829

Event History

Mar 29, 2004

CVE Published

05:00 AM

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-0993?

CVE-2003-0993 is classified as a moderate vulnerability that could allow remote attackers to bypass access restrictions.

How do I fix CVE-2003-0993?

To fix CVE-2003-0993, upgrade to Apache HTTP Server version 1.3.30 or later.

What are the affected versions for CVE-2003-0993?

CVE-2003-0993 affects Apache HTTP Server versions 1.3 up to 1.3.29 on big-endian 64-bit platforms.

Can CVE-2003-0993 be exploited remotely?

Yes, CVE-2003-0993 can be exploited by remote attackers to bypass intended access restrictions.

What are the implications of CVE-2003-0993 for my Apache server?

Due to CVE-2003-0993, your Apache server may unintentionally allow some unauthorized access if it uses Allow/Deny rules without a netmask.