CVE-2001-0834
htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- conectiva:linux
- debian:debian_linux
- htdig:htdig
- suse:suse_linux
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000429
- http://marc.info/?l=bugtraq&m=100260195401753&w=2
- http://sourceforge.net/tracker/index.php?func=detail&aid=458013&group_id=4593&atid=104593
- http://www.calderasystems.com/support/security/advisories/CSSA-2001-035.0.txt
- http://www.debian.org/security/2001/dsa-080