 LSS Security Team has reported a weakness in mod_dosevasive for Apache, which can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges.
Temporary files are created insecurely and can be exploited via symlink attacks
to create arbitrary files containing action trace log information on the system.
Combined with a minor race condition, this can potentially be exploited to
overwrite existing files.
The vulnerability has been reported in versions 1.9 and prior.
SOFTWARE:
mod_dosevasive 1.x (module for Apache)
SOLUTION:
Grant only trusted users access to a vulnerable system.
PROVIDED AND/OR DISCOVERED BY:
LSS Security Team
ORIGINAL ADVISORY:
http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01
VERIFY ADVISORY:
http://secunia.com/advisories/13725/
Secunia Security Advisories
| 
Contribute :
Advanced Search :
Web Resources :
Polls :
File Repository
