Vulnerability CVE-2002-0107 - CERT Civis.Net

Vulnerability Name:

CVE-2002-0107 (CCN-7835)

Assigned:

2002-01-08

Published:

2002-01-08

Updated:

2016-10-18

Summary:

Web administration interface in CacheFlow CacheOS 4.0.13 and earlier allows remote attackers to obtain sensitive information via a series of GET requests that do not end in with HTTP/1.0 or another version string, which causes the information to be leaked in the error message.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: CCN
Type: BugTraq Mailing List, Tue Jan 08 2002 - 16:14:59 CST
svindel.net security advisory - web admin vulnerability in CacheOS

Source: CCN
Type: BugTraq Mailing List, Tue Feb 05 2002 - 11:25:06 CST
RE: svindel.net security advisory - web admin vulnerability in Ca cheOS

Source: MITRE
Type: CNA
CVE-2002-0107

Source: CCN
Type: CacheFlow Web site
Software Download Site

Source: BUGTRAQ
Type: UNKNOWN
20020108 svindel.net security advisory - web admin vulnerability in CacheOS

Source: BUGTRAQ
Type: Exploit, Patch, Vendor Advisory
20020205 RE: svindel.net security advisory - web admin vulnerability in Ca cheOS

Source: XF
Type: Patch, Vendor Advisory
cachos-insecure-web-interface(7835)

Source: CCN
Type: OSVDB ID: 2020
Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage

Source: CCN
Type: OSVDB ID: 4988
CacheFlow CacheOS GET Information Disclosure

Source: BID
Type: Exploit, Patch, Vendor Advisory
3841

Source: CCN
Type: BID-3841
Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage Vulnerability

Source: XF
Type: UNKNOWN
cachos-insecure-web-interface(7835)

Vulnerable Configuration:

Configuration 1:

cpe:/a:cacheflow:cacheos:0.0:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.02:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.03:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.04:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.05:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.06:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.07:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.08:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.09:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.10:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.11:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.12:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.13:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.14:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.15:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.16:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.17:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.18:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.19:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:3.1.20:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:4.0.11:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:4.0.12:*:*:*:*:*:*:*

OR cpe:/a:cacheflow:cacheos:4.0.13:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:bluecoat:cacheos:-:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:3.1.17:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:3.1.18:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:3.1.19:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:4.0.11:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:4.0.12:*:*:*:*:*:*:*

OR cpe:/o:bluecoat:cacheos:4.0.13:*:*:*:*:*:*:*

Denotes that component is vulnerable