CVE-2000-1191 Information disclosure in n/a
Remote attackers can determine the server's physical path by requesting a non-existent configuration file, exposing internal directory structures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2000-1191?
CVE-2000-1191 is a medium-severity vulnerability in n/a, published on 12 Sep 2001. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path.
Weakness: CWE-209
Which versions are affected by CVE-2000-1191?
It affects 1 product.
Linux distribution packages (8)
htdig Red Hat:enterprise_linux:3::as | All versions | 2:3.1.6-7.el3 |
htdig-debuginfo Red Hat:enterprise_linux:3::as | All versions | 2:3.1.6-7.el3 |
htdig Red Hat:enterprise_linux:3::desktop | All versions | 2:3.1.6-7.el3 |
htdig-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 2:3.1.6-7.el3 |
htdig Red Hat:enterprise_linux:3::es | All versions | 2:3.1.6-7.el3 |
htdig-debuginfo Red Hat:enterprise_linux:3::es | All versions | 2:3.1.6-7.el3 |
htdig Red Hat:enterprise_linux:3::ws | All versions | 2:3.1.6-7.el3 |
htdig-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 2:3.1.6-7.el3 |
Products include Htdig Project Htdig.
How do I fix CVE-2000-1191?
Apply the vendor's patch.
Is CVE-2000-1191 being exploited?
There is no known exploitation of CVE-2000-1191 in the wild and no public exploit code.
Sources
Also known as GHSA-7c6m-w964-4jjh, RHBA-2007:0026.