Details of VAR-200902-0686

ID

VAR-200902-0686

CVE

CVE-2003-1568

TITLE

GoAhead WebServer 'websSafeUrl function ' Denial of service vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200902-119

DESCRIPTION

GoAhead WebServer before 2.1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an invalid URL, related to the websSafeUrl function. GoAhead WebServer is prone to an authentication-bypass vulnerability and multiple denial-of-service vulnerabilities. A remote attacker may exploit these issues to gain access to protected documents or to create a denial-of-service condition. Versions prior to GoAhead WebServer 2.1.6 are vulnerable. GoAhead WebServer is a WEB publishing service system software. The vulnerability is related to the websSafeUrl function

Trust: 1.26

sources: NVD: CVE-2003-1568 // BID: 33838 // VULHUB: VHN-8393

AFFECTED PRODUCTS

vendor:	goahead	model:	webserver	scope:	eq	version:	2.1.3	Trust: 1.6
vendor:	goahead	model:	webserver	scope:	eq	version:	2.1.4	Trust: 1.6
vendor:	goahead	model:	webserver	scope:	eq	version:	2.1.2	Trust: 1.0
vendor:	goahead	model:	webserver	scope:	eq	version:	2.1	Trust: 1.0
vendor:	goahead	model:	webserver	scope:	eq	version:	2.0	Trust: 1.0
vendor:	goahead	model:	webserver	scope:	eq	version:	2.1.1	Trust: 1.0
vendor:	goahead	model:	webserver	scope:	lte	version:	2.1.5	Trust: 1.0
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1	Trust: 0.6
vendor:	goahead	model:	webserver	scope:	eq	version:	2.1.5	Trust: 0.6
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1.5	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1.4	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1.3	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1.2	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.1.1	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	eq	version:	2.0	Trust: 0.3
vendor:	goahead	model:	software goahead webserver	scope:	ne	version:	2.1.6	Trust: 0.3

sources: BID: 33838 // CNNVD: CNNVD-200902-119 // NVD: CVE-2003-1568

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2003-1568
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-200902-119
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-8393
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2003-1568
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-8393
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-8393 // CNNVD: CNNVD-200902-119 // NVD: CVE-2003-1568

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.1

sources: VULHUB: VHN-8393 // NVD: CVE-2003-1568

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200902-119

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200902-119

EXTERNAL IDS

db:	NVD	id:	CVE-2003-1568	Trust: 2.0
db:	CNNVD	id:	CNNVD-200902-119	Trust: 0.7
db:	BID	id:	33838	Trust: 0.3
db:	VULHUB	id:	VHN-8393	Trust: 0.1

sources: VULHUB: VHN-8393 // BID: 33838 // CNNVD: CNNVD-200902-119 // NVD: CVE-2003-1568

REFERENCES

url:	http://data.goahead.com/software/webserver/2.1.8/release.htm#null-pointer-crash-in-webssafeurl	Trust: 1.7
url:	http://data.goahead.com/software/webserver/2.1.6/release.htm	Trust: 0.3
url:	http://www.goahead.com/	Trust: 0.3

sources: VULHUB: VHN-8393 // BID: 33838 // CNNVD: CNNVD-200902-119 // NVD: CVE-2003-1568

CREDITS

Richard Cullen, Luigi Auriemma, and the vendor.

Trust: 0.9

sources: BID: 33838 // CNNVD: CNNVD-200902-119

SOURCES

db:	VULHUB	id:	VHN-8393
db:	BID	id:	33838
db:	CNNVD	id:	CNNVD-200902-119
db:	NVD	id:	CVE-2003-1568

LAST UPDATE DATE

2024-08-14T13:49:48.893000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-8393	date:	2009-02-09T00:00:00
db:	BID	id:	33838	date:	2009-02-19T22:10:00
db:	CNNVD	id:	CNNVD-200902-119	date:	2009-02-09T00:00:00
db:	NVD	id:	CVE-2003-1568	date:	2009-02-09T05:00:00

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-8393	date:	2009-02-06T00:00:00
db:	BID	id:	33838	date:	2002-10-17T00:00:00
db:	CNNVD	id:	CNNVD-200902-119	date:	2009-02-06T00:00:00
db:	NVD	id:	CVE-2003-1568	date:	2009-02-06T19:30:00.390