Vulnerability Description
Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 1.3.0, < 1.3.26 |
References
- http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_log_configBroken Link
- http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/loggers/mod_log_config.c?onlBroken Link
- http://marc.info/?l=bugtraq&m=108024081011678&w=2Issue TrackingThird Party Advisory
- http://marc.info/?l=bugtraq&m=108034113406858&w=2Issue TrackingThird Party Advisory
- http://secunia.com/advisories/8146Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2003-139.htmlThird Party Advisory
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e0593
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181e
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b21
- https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390
- https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab3827
- https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4
- https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426
FAQ
What is CVE-2003-0083?
CVE-2003-0083 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into te...
How severe is CVE-2003-0083?
CVE-2003-0083 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-0083?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server.