VulnerabilityModified
CVE-2002-1658
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument.
MEDIUM 4.6EPSS 1.05%
Does this matter?
Lower severity and a low EPSS score (1.05%). Track it; it rarely justifies an emergency change on its own.
Description
Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
- CVSS 2.0
- 4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.05% probability · 62th percentile
- CISA KEV
- Not listed
- Affected
- apache/http server
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=103480856102007&w=2
- http://www.securityfocus.com/bid/5993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10414
- https://sardonix.org/audit/apache-45.htmlExploit
- http://marc.info/?l=bugtraq&m=103480856102007&w=2
- http://www.securityfocus.com/bid/5993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10414
- https://sardonix.org/audit/apache-45.htmlExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.