Vulnerability Description
mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | 1.3 |
| Apple | Apache Mod Digest Apple | All versions |
| Avaya | Communication Manager | 1.1 |
| Avaya | Intuity Audix Lx | All versions |
| Hp | Virtualvault | 4.5 |
| Hp | Webproxy | a.02.00 |
| Ibm | Http Server | 1.3.19 |
| Avaya | Mn100 | All versions |
| Avaya | Network Routing | All versions |
| Avaya | Modular Messaging Message Storage Server | 1.1 |
| Openbsd | Openbsd | 3.4 |
| Sco | Openserver | 5.0.6 |
| Sun | Solaris | 8.0 |
| Sun | Sunos | 5.8 |
References
- http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.htmlPatchVendor Advisory
- http://www.ciac.org/ciac/bulletins/p-049.shtmlPatchVendor Advisory
- http://www.securityfocus.com/bid/9571PatchVendor Advisory
- http://www.securitytracker.com/alerts/2004/Dec/1012414.htmlPatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18347
- http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.htmlPatchVendor Advisory
- http://www.ciac.org/ciac/bulletins/p-049.shtmlPatchVendor Advisory
- http://www.securityfocus.com/bid/9571PatchVendor Advisory
- http://www.securitytracker.com/alerts/2004/Dec/1012414.htmlPatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18347
FAQ
What is CVE-2004-1082?
CVE-2004-1082 is a vulnerability with a CVSS score of 7.5 (HIGH). mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
How severe is CVE-2004-1082?
CVE-2004-1082 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2004-1082?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Apple Apache Mod Digest Apple, Avaya Communication Manager, Avaya Intuity Audix Lx, Hp Virtualvault.