CVE-2013-1862

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

References

http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch

http://svn.apache.org/viewvc?view=revision&revision=r1469311

https://bugzilla.redhat.com/show_bug.cgi?id=953729

http://rhn.redhat.com/errata/RHSA-2013-0815.html

http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html

http://www.ubuntu.com/usn/USN-1903-1

http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html

http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html

http://www-01.ibm.com/support/docview.wss?uid=swg21644047

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862

https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

http://rhn.redhat.com/errata/RHSA-2013-1209.html

http://rhn.redhat.com/errata/RHSA-2013-1207.html

http://rhn.redhat.com/errata/RHSA-2013-1208.html

http://secunia.com/advisories/55032

http://www.securityfocus.com/bid/64758

http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

http://www.mandriva.com/security/advisories?name=MDVSA-2013:174

http://support.apple.com/kb/HT6150

http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html

http://www.securityfocus.com/bid/59826

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2013-06-10

Updated: 2021-06-06

Type: CWE-310

Risk Information

CVSS v2

Base Score: 5.1

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 4.9

Severity: MEDIUM

Tenable Plugins

View all (36 total)

IDNameProductFamilySeverity
144084IBM HTTP Server 8.5.0.0 <= 8.5.5.0 / 8.0.0.0 <= 8.0.0.6 / 7.0.0.0 <= 7.0.0.29 / 6.1.0.0 <= 6.1.0.45 (491411)NessusWeb Servers
medium
84878Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685) (credentialed check)NessusMisc.
medium
84877Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685)NessusMisc.
medium
83632SUSE SLES10 Security Update : apache2 (SUSE-SU-2014:1082-1)NessusSuSE Local Security Checks
medium
80585Oracle Solaris Third-Party Patch Update : apache (cve_2013_1896_denial_of)NessusSolaris Local Security Checks
medium
80195Juniper Junos Space < 13.3R1.8 Multiple Vulnerabilities (JSA10627)NessusJunos Local Security Checks
critical
80043openSUSE Security Update : apache2 (openSUSE-SU-2014:1647-1)NessusSuSE Local Security Checks
medium
79603F5 Networks BIG-IP : Apache vulnerability (SOL15877)NessusF5 Networks Local Security Checks
medium
76239RHEL 5 / 6 : JBoss Web Server (RHSA-2013:1133)NessusRed Hat Local Security Checks
medium
75110openSUSE Security Update : apache2 (openSUSE-SU-2013:1340-1)NessusSuSE Local Security Checks
medium
75109openSUSE Security Update : apache2 (openSUSE-SU-2013:1337-1)NessusSuSE Local Security Checks
medium
8138Mac OS X < 10.9.2 Multiple Vulnerabilities Nessus Network MonitorWeb Clients
critical
72688Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)NessusMacOS X Local Security Checks
critical
72687Mac OS X 10.9.x < 10.9.2 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
72238JBoss Enterprise Application Platform 6.1.1 Update (RHSA-2013:1209)NessusRed Hat Local Security Checks
medium
72061IBM WebSphere Application Server 7.0 < Fix Pack 31 Multiple VulnerabilitiesNessusWeb Servers
medium
71229IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple VulnerabilitiesNessusWeb Servers
medium
70085GLSA-201309-12 : Apache HTTP Server: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
70022IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple VulnerabilitiesNessusWeb Servers
critical
69883RHEL 6 : JBoss EAP (RHSA-2013:1208)NessusRed Hat Local Security Checks
medium
69882RHEL 5 : JBoss EAP (RHSA-2013:1207)NessusRed Hat Local Security Checks
medium
69752Amazon Linux AMI : httpd24 (ALAS-2013-194)NessusAmazon Linux Local Security Checks
medium
69751Amazon Linux AMI : httpd (ALAS-2013-193)NessusAmazon Linux Local Security Checks
medium
69474SuSE 11.2 / 11.3 Security Update : Apache2 (SAT Patch Numbers 8137 / 8138)NessusSuSE Local Security Checks
medium
69449IBM WebSphere Application Server 8.0 < Fix Pack 7 Multiple VulnerabilitiesNessusWeb Servers
high
68915Apache 2.2.x < 2.2.25 Multiple VulnerabilitiesNessusWeb Servers
medium
68914Apache 2.0.x < 2.0.65 Multiple VulnerabilitiesNessusWeb Servers
critical
68902Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : apache2 vulnerabilities (USN-1903-1)NessusUbuntu Local Security Checks
medium
68819Oracle Linux 5 / 6 : httpd (ELSA-2013-0815)NessusOracle Linux Local Security Checks
medium
67194FreeBSD : apache22 -- several vulnerabilities (f3d24aee-e5ad-11e2-b183-20cf30e32f6d)NessusFreeBSD Local Security Checks
medium
66899Mandriva Linux Security Advisory : apache (MDVSA-2013:174)NessusMandriva Local Security Checks
medium
66441Scientific Linux Security Update : httpd on SL5.x, SL6.x i386/x86_64 (20130513)NessusScientific Linux Local Security Checks
medium
66403RHEL 5 / 6 : httpd (RHSA-2013:0815)NessusRed Hat Local Security Checks
medium
66397CentOS 5 / 6 : httpd (CESA-2013:0815)NessusCentOS Local Security Checks
medium
801383Apache 2.2.x < 2.2.25 Remote Denial of Service VulnerabilityLog Correlation EngineWeb Servers
medium
6927Apache 2.2.x < 2.2.25 Remote Denial of Service VulnerabilityNessus Network MonitorWeb Servers
low