CVE-2001-0834 Information disclosure in n/a
Remote attackers can read arbitrary files or cause denial of service by specifying an alternate configuration file in the htsearch CGI program.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-0834?
CVE-2001-0834 is a medium-severity vulnerability in Conectiva Linux, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.
Which versions are affected by CVE-2001-0834?
It affects 4 products.
Products include Conectiva Linux, Debian Debian Linux, Htdig Htdig, Suse Suse Linux.
How do I fix CVE-2001-0834?
No fix has been published for CVE-2001-0834 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-0834 being exploited?
There is no known exploitation of CVE-2001-0834 in the wild and no public exploit code.
Other vulnerabilities in Conectiva Linux
Sources
Also known as GHSA-v6hf-54vc-wr5c.