Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache 2.0.52 htdigest may run unwanted code

CVE-2005-1344 · published 21 years ago
Summary

The htdigest tool that ships with Apache 2.0.52 can be confused by an overly long input, potentially causing it to run code supplied by an attacker. This is a concern only if the tool can be reached from the network or invoked by other web programs; otherwise the chance of harm is small. Update Apache to a newer version and limit who can call htdigest.

What to do
  • Update debian apache2 to version 2.0.54-3.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian apache2 < 2.0.54-3
Fix: upgrade to 2.0.54-3
Debian:13 debian apache2 < 2.0.54-3
Fix: upgrade to 2.0.54-3
Debian:14 debian apache2 < 2.0.54-3
Fix: upgrade to 2.0.54-3
– apache http_server 2.0.52
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or set...
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
References
Severity
7.5 High
Exploitation
29% chance of attack within 30 days
Timeline
Published2 May 2005
Updated15 Oct 2026
First seen8 Sep 2026
Sources
DEBIAN-CVE-2005-1344 · OSV
CVE-2005-1344 · NVD
Track software like this
Free during beta