Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.

Luca Ercoli discovered that the 'htdigest' program did not perform any bounds checking when it copied the 'user' and 'realm' arguments into local buffers. If this program is used in remotely callable CGI scripts, this could be exploited by a remote attacker to execute arbitrary code with the privileges of the CGI script.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the 'htdigest' utilility.  Specifically, a long user-supplied realm will cause an overflow and execution of arbitrary code.  This issue is not considered a local flaw, as the program is not run setuid.  An attacker exploiting this flaw would need to find a vulnerable Apache Web server that was making a call to 'htdigest' via a CGI script.    

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host is missing Security Update 2005-005. This security update contains fixes for the following applications :

  - Apache
  - AppKit
  - AppleScript
  - Bluetooth
  - Directory Services
  - Finder
  - Foundation
  - HelpViewer
  - LDAP
  - libXpm
  - lukemftpd
  - NetInfo
  - ServerAdmin
  - sudo
  - Terminal
  - VPN

These programs have multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

ID	Name	Product	Family	Severity
20509	Ubuntu 4.10 / 5.04 : apache2 vulnerability (USN-120-1)	Nessus	Ubuntu Local Security Checks	high
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
2884	Apache htdigest realm Variable Overflow	Nessus Network Monitor	Web Servers	medium
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	high
18189	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2005-1344

critical

Tenable Plugins

high

critical

medium

high

high