CVE-2013-1862
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 25%
exploitation probability
25%top 2% of all CVEs
observed exploitation
nono source reports it
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
Affected products
n/a · n/aReferences
http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00030.htmlhttp://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patchhttp://rhn.redhat.com/errata/RHSA-2013-0815.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1207.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1208.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1209.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=953729http://secunia.com/advisories/55032https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetokenhttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E