CVE: CVE-2003-0844

Export to Word

mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00086
Percentile: 0.25881

CVSS Scoring

CVSS v3.1 Score: 7.1

Severity: HIGH

Mapped CWE(s)

CWE-59 : Improper Link Resolution Before File Access ('Link Following')

All CAPEC(s)

CAPEC-132: Symlink Attack
CAPEC-17: Using Malicious Files
CAPEC-35: Leverage Executable Code in Non-Executable Files
CAPEC-76: Manipulating Web Input to File System Calls

CAPEC(s) with Mapped TTPs

CAPEC-132: Symlink Attack
Mapped TTPs:
- T1547.009 : Shortcut Modification
CAPEC-17: Using Malicious Files
Mapped TTPs:
- T1574.005 : Executable Installer File Permissions Weakness
- T1574.010 : Services File Permissions Weakness
CAPEC-35: Leverage Executable Code in Non-Executable Files
Mapped TTPs:
- T1027.006 : HTML Smuggling
- T1027.009 : Embedded Payloads
- T1564.009 : Resource Forking

Mapped ATT&CK TTPs

T1547.009 : Shortcut Modification
Kill Chain: persistence
T1574.005 : Executable Installer File Permissions Weakness
Kill Chain: persistence
T1574.010 : Services File Permissions Weakness
Kill Chain: persistence
T1027.006 : HTML Smuggling
Kill Chain: defense-evasion
T1027.009 : Embedded Payloads
Kill Chain: defense-evasion
T1564.009 : Resource Forking
Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

C0021

Affected Products

cpe:2.3:a:schroepl:mod_gzip:*:*:*:*:*:*:*:*

← Back to Home