[MBT] new ticket for pkg apache "CAN-2001-0131 CAN-2002-1233"

[bugs at pld.org.pl]

Date: 2002-11-26 10:21:17+01	Author:  (kreutzm) <kreutzm at itp.uni-hannover.de> 
Title:         CAN-2001-0131 CAN-2002-1233
Ticket ID:     #464
Ticket URL:    http://bugs.pld.org.pl/?bug=464
Package:       apache-1.3.26-5
Distribution:  PLD-Ra.main
Category:      security problem
Current state: opened
Text:

According to the changelog 
CAN-2001-0131 CAN-2002-1233
are NOT applied to the PLD apache. From the debian security announcement (DSA 187-1 and DSA 188-1):

4. CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program.

5. CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via asymlink attack.

This is the same vulnerability as CAN-2002-1233, which was fixed in potato already but got lost later and was never applied upstream.


Also the debian announcements mentions:
5. NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings.
but this looks like 843 ?