Sign-up

ID

VAR-200109-0134


CVE

CVE-2001-1446


TITLE

Apache web server performs case sensitive filtering on Mac OS X HFS+ case insensitive filesystem

Trust: 0.8

sources: CERT/CC: VU#439395

DESCRIPTION

Find-By-Content in Mac OS X 10.0 through 10.0.4 creates world-readable index files named .FBCIndex in every directory, which allows remote attackers to learn the contents of files in web accessible directories. The Apache (1.3.14) web server's file access protection scheme can be bypassed for the Mac OS X HFS+ filesystem. Mac OS X's Find-By-Content indexing may store file data where it can be served to remote users by Apache. Requesting a URL with the relative path of a '.DS_Store' file, will reveal the contents of the requested directory. This vulnerability could be used in conjunction with a previously discovered issue (BID 2852), which causes files to be arbitrarily disclosed through mixed case file requests. A remote attacker may read the indexed contents of files by submitting a URL to the vulnerable host's web service of the following form: http://www.example.com/target_directory/.FBCIndex. This information could provide an attacker with sensitive information including potential passwords useful in dictionary attacks, system configuration, installed applications, etc. Properly exploited, this information could allow an attacker to further compromise the security of the host

Trust: 2.97

sources: NVD: CVE-2001-1446 // CERT/CC: VU#439395 // CERT/CC: VU#177243 // BID: 3316 // BID: 3325 // VULHUB: VHN-4250

AFFECTED PRODUCTS

vendor:apple computermodel: - scope: - version: -

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.4

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.1

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.3

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.0.2

Trust: 1.6

vendor:apachemodel: - scope: - version: -

Trust: 0.8

vendor:apachemodel:macscope:eqversion:1.3.14

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.8

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.7

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.3

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.8

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.7

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.2

Trust: 0.3

sources: CERT/CC: VU#439395 // CERT/CC: VU#177243 // BID: 3316 // BID: 3325 // CNNVD: CNNVD-200109-036 // NVD: CVE-2001-1446

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2001-1446
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#439395
value: 3.60

Trust: 0.8

CARNEGIE MELLON: VU#177243
value: 11.25

Trust: 0.8

CNNVD: CNNVD-200109-036
value: HIGH

Trust: 0.6

VULHUB: VHN-4250
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2001-1446
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-4250
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#439395 // CERT/CC: VU#177243 // VULHUB: VHN-4250 // CNNVD: CNNVD-200109-036 // NVD: CVE-2001-1446

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-1446

THREAT TYPE

network

Trust: 0.6

sources: BID: 3316 // BID: 3325

TYPE

access verification error

Trust: 0.6

sources: CNNVD: CNNVD-200109-036

EXTERNAL IDS

db:BIDid:3325

Trust: 2.8

db:CERT/CCid:VU#177243

Trust: 2.8

db:BIDid:3316

Trust: 1.9

db:NVDid:CVE-2001-1446

Trust: 1.7

db:BIDid:2852

Trust: 0.8

db:CERT/CCid:VU#439395

Trust: 0.8

db:CNNVDid:CNNVD-200109-036

Trust: 0.7

db:BUGTRAQid:20010910 RE: MORE SECURITY PROBLEMS IN APACHE ON MAC OS X

Trust: 0.6

db:XFid:7103

Trust: 0.6

db:VULHUBid:VHN-4250

Trust: 0.1

sources: CERT/CC: VU#439395 // CERT/CC: VU#177243 // VULHUB: VHN-4250 // BID: 3316 // BID: 3325 // CNNVD: CNNVD-200109-036 // NVD: CVE-2001-1446

REFERENCES

url:http://www.securityfocus.com/bid/3325

Trust: 2.5

url:http://www.kb.cert.org/vuls/id/177243

Trust: 2.0

url:http://archives.neohapsis.com/archives/bugtraq/2001-09/0085.html

Trust: 1.7

url:http://www.securityfocus.com/bid/3316

Trust: 1.6

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/7103

Trust: 1.1

url:http://www.securityfocus.com/bid/2852

Trust: 0.8

url:http://www.apple.com/downloads/macosx/apple/websharingupdate.html

Trust: 0.8

url:http://www.macintouch.com/mosxreaderreports43

Trust: 0.8

url:http://httpd.apache.org/docs/mod/core.html#directory

Trust: 0.8

url:http://httpd.apache.org/docs/misc/security_tips.html

Trust: 0.8

url:http://xforce.iss.net/xforce/xfdb/7103

Trust: 0.6

url:http://www.securityfocus.com/vdb/bottom.html?vid=2852

Trust: 0.3

url:http://www.kb.cert.org/vuls/id/svim-53nukh

Trust: 0.3

sources: CERT/CC: VU#439395 // CERT/CC: VU#177243 // VULHUB: VHN-4250 // BID: 3316 // BID: 3325 // CNNVD: CNNVD-200109-036 // NVD: CVE-2001-1446

CREDITS

Reported to bugtraq by Eric Bennett <emb22@cornell.edu> on September 10, 2001.

Trust: 0.9

sources: BID: 3325 // CNNVD: CNNVD-200109-036

SOURCES

db:CERT/CCid:VU#439395
db:CERT/CCid:VU#177243
db:VULHUBid:VHN-4250
db:BIDid:3316
db:BIDid:3325
db:CNNVDid:CNNVD-200109-036
db:NVDid:CVE-2001-1446

LAST UPDATE DATE

2024-08-14T14:23:16.193000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#439395date:2003-06-02T00:00:00
db:CERT/CCid:VU#177243date:2005-03-28T00:00:00
db:VULHUBid:VHN-4250date:2017-07-11T00:00:00
db:BIDid:3316date:2001-09-10T00:00:00
db:BIDid:3325date:2001-09-11T00:00:00
db:CNNVDid:CNNVD-200109-036date:2005-10-20T00:00:00
db:NVDid:CVE-2001-1446date:2017-07-11T01:29:07.617

SOURCES RELEASE DATE

db:CERT/CCid:VU#439395date:2001-09-28T00:00:00
db:CERT/CCid:VU#177243date:2002-08-05T00:00:00
db:VULHUBid:VHN-4250date:2001-09-11T00:00:00
db:BIDid:3316date:2001-09-10T00:00:00
db:BIDid:3325date:2001-09-11T00:00:00
db:CNNVDid:CNNVD-200109-036date:2001-09-11T00:00:00
db:NVDid:CVE-2001-1446date:2001-09-11T04:00:00