National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2002-0840 Detail

Description

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Source:  MITRE      Last Modified:  10/11/2002

Quick Info

CVE Dictionary Entry:
CVE-2002-0840
Original release date:
10/11/2002
Last revised:
10/09/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
6.8 MEDIUM
Vector:
(AV:N/AC:M/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore:
6.4
Exploitability Subscore:
8.6
CVSS Version 2 Metrics:
Access Vector:
Network exploitable
Access Complexity:
Medium
Authentication:
Not required to exploit
Impact Type:
Provides user account access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.43 and 1.3.27: http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_13.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I External Source SGI 20021105-02-I
http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html External Source BUGTRAQ 20021017 TSLSA-2002-0069-apache
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html External Source VULNWATCH 20021002 Apache 2 Cross-Site Scripting
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000530 External Source CONECTIVA CLA-2002:530
http://marc.info/?l=apache-httpd-announce&m=103367938230488&w=2 External Source CONFIRM http://marc.info/?l=apache-httpd-announce&m=103367938230488&w=2
http://marc.info/?l=bugtraq&m=103357160425708&w=2 External Source BUGTRAQ 20021002 Apache 2 Cross-Site Scripting
http://marc.info/?l=bugtraq&m=103376585508776&w=2 External Source BUGTRAQ 20021003 [OpenPKG-SA-2002.009] OpenPKG Security Advisory (apache)
http://online.securityfocus.com/advisories/4617 External Source HP HPSBUX0210-224
http://www.apacheweek.com/issues/02-10-04 Vendor Advisory External Source CONFIRM http://www.apacheweek.com/issues/02-10-04
http://www.debian.org/security/2002/dsa-187 External Source DEBIAN DSA-187
http://www.debian.org/security/2002/dsa-188 External Source DEBIAN DSA-188
http://www.debian.org/security/2002/dsa-195 External Source DEBIAN DSA-195
http://www.kb.cert.org/vuls/id/240329 US Government Resource External Source CERT-VN VU#240329
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-068.php External Source MANDRAKE MDKSA-2002:068
http://www.linuxsecurity.com/advisories/other_advisory-2414.html External Source ENGARDE ESA-20021007-024
http://www.redhat.com/support/errata/RHSA-2002-222.html External Source REDHAT RHSA-2002:222
http://www.redhat.com/support/errata/RHSA-2002-243.html External Source REDHAT RHSA-2002:243
http://www.redhat.com/support/errata/RHSA-2002-244.html External Source REDHAT RHSA-2002:244
http://www.redhat.com/support/errata/RHSA-2002-248.html External Source REDHAT RHSA-2002:248
http://www.redhat.com/support/errata/RHSA-2002-251.html External Source REDHAT RHSA-2002:251
http://www.redhat.com/support/errata/RHSA-2003-106.html External Source REDHAT RHSA-2003:106
http://www.securityfocus.com/bid/5847 External Source BID 5847
https://exchange.xforce.ibmcloud.com/vulnerabilities/10241 External Source XF apache-http-host-xss(10241)

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2:r2:*:*:*:*:*:*
cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:9.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle8i:8.1.7_.0.0_enterprise:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle8i:8.1.7_.1.0_enterprise:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle9i:9.0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle9i:9.0.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oracle9i:9.0.2:*:*:*:*:*:*:*

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 3 change records found - show changes