{"id": "CVE-2000-0883", "bulletinFamily": "NVD", "title": "CVE-2000-0883", "description": "The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.", "published": "2000-11-14T05:00:00", "modified": "2017-10-10T01:29:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0883", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/5257", "http://www.securityfocus.com/bid/1678", "http://archives.neohapsis.com/archives/bugtraq/2000-09/0111.html"], "cvelist": ["CVE-2000-0883"], "type": "cve", "lastseen": "2019-05-29T18:07:37", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "7560bb516ae20c4c214f24d3a1a52609"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "0371da18403e15fc10aebed43503eaef"}, {"key": "cpe23", "hash": "8488a04ee187a3fd4fb40bc3834b3e4c"}, {"key": "cvelist", "hash": "43d9849641a6978a8f231812e2934160"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "cvss2", "hash": "f30109dfdbfbf783c0b61792a6b2c20a"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "4aad4dfb429ef44a93a1473e17996298"}, {"key": "href", "hash": "6d236337935524af259bffdc84bc1605"}, {"key": "modified", "hash": "2c52e3b4571b0154b8982c1cb76da83c"}, {"key": "published", "hash": "7ec7544433c38f957e73ebb3ab249b27"}, {"key": "references", "hash": "31b18e6ba87b2b35074359090182c967"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "58f8f8a2922b7b085ac0349c235b0670"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "66a80af576ad01cc508b1177aa6c241d9b34b2d993eed55cb81ed676763a83cb", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:20220"]}, {"type": "nessus", "idList": ["PERL_BROWSEABLE.NASL", "MANDRAKE_MDKSA-2000-046.NASL"]}, {"type": "osvdb", "idList": ["OSVDB:410"]}], "modified": "2019-05-29T18:07:37"}, "score": {"value": 6.5, "vector": "NONE", "modified": "2019-05-29T18:07:37"}, "vulnersScore": 6.5}, "objectVersion": "1.3", "cpe": ["cpe:/o:mandrakesoft:mandrake_linux:7.0", "cpe:/o:mandrakesoft:mandrake_linux:7.1", "cpe:/a:mandrakesoft:mandrake_linux:7.0", "cpe:/o:mandrakesoft:mandrake_linux:6.1", "cpe:/a:mandrakesoft:mandrake_linux:7.1", "cpe:/a:mandrakesoft:mandrake_linux:6.1"], "affectedSoftware": [{"name": "mandrakesoft mandrake_linux", "operator": "eq", "version": "7.0"}, {"name": "mandrakesoft mandrake_linux", "operator": "eq", "version": "7.1"}, {"name": "mandrakesoft mandrake_linux", "operator": "eq", "version": "6.1"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*", "cpe:2.3:o:mandrakesoft:mandrake_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:mandrakesoft:mandrake_linux:6.1:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:19:55", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nVendor URL: http://perl.apache.org/\nISS X-Force ID: 5257\n[CVE-2000-0883](https://vulners.com/cve/CVE-2000-0883)\nBugtraq ID: 1678\n", "modified": "2000-09-11T00:00:00", "published": "2000-09-11T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:410", "id": "OSVDB:410", "type": "osvdb", "title": "mod_perl for Apache HTTP Server /perl/ Directory Listing", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "nessus": [{"lastseen": "2017-01-01T22:11:27", "bulletinFamily": "scanner", "description": "The /perl directory is browsable. This will show you the name of the installed common perl scripts and those that are written by the webmaster and thus may be exploitable.\n\nThis plugin has been deprecated. Webmirror3 (plugin ID 10662) will identify a browsable directory.", "modified": "2016-12-30T00:00:00", "published": "2000-09-12T00:00:00", "id": "PERL_BROWSEABLE.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=10511", "type": "nessus", "title": "mod_perl for Apache HTTP Server /perl/ Directory Listing (deprecated)", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# @DEPRECATED@\n#\n# Disabled on 2016/04/01. Webmirror3.nbin will identify browsable\n# directories.\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(10511);\n script_version (\"$Revision: 1.22 $\");\n script_cvs_date(\"$Date: 2016/12/30 22:07:39 $\");\n\n script_cve_id(\"CVE-2000-0883\");\n script_bugtraq_id(1678);\n script_osvdb_id(410);\n\n script_name(english:\"mod_perl for Apache HTTP Server /perl/ Directory Listing (deprecated)\");\n script_summary(english:\"Checks if /perl browsable.\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"This plugin has been deprecated.\");\n script_set_attribute(attribute:\"description\", value:\n\"The /perl directory is browsable. This will show you the name of the\ninstalled common perl scripts and those that are written by the\nwebmaster and thus may be exploitable.\n\nThis plugin has been deprecated. Webmirror3 (plugin ID 10662) will\nidentify a browsable directory.\");\n script_set_attribute(attribute:\"solution\", value:\"n/a\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2000/09/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2000/09/12\");\n \n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Web Servers\");\n\n script_copyright(english:\"This script is Copyright (C) 2000-2016 Tenable Network Security, Inc.\");\n\n script_dependencie(\"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\n# Deprecated.\nexit(0, \"This plugin has been deprecated. Webmirror3 (plugin ID 10662) will identify a browsable directory.\");\n\n#\n# The script code starts here\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\nport = get_http_port(default:80);\n\nr = http_send_recv3(method: \"GET\", item:\"/perl/\", port:port);\nif (isnull(r)) exit(1, \"Server did not answer\");\n\nif (\" 200 \" >< r[0])\n{\n buf = tolower(r[2]);\n must_see = \"index of /perl\";\n\n if (must_see >< buf)\n {\n security_warning(port);\n set_kb_item(name: 'www/'+port+'/content/directory_index', value: '/perl:');\n }\n}\n\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2019-11-01T02:54:54", "bulletinFamily": "scanner", "description": "The configuration file, /etc/httpd/conf/addon-modules/mod_perl.conf\ncontained an Options directive that was not entirely secure and\nallowed people to browse the /perl/ directory. This update adds the\n", "modified": "2019-11-02T00:00:00", "id": "MANDRAKE_MDKSA-2000-046.NASL", "href": "https://www.tenable.com/plugins/nessus/61838", "published": "2012-09-06T00:00:00", "title": "Mandrake Linux Security Advisory : mod_perl (MDKSA-2000:046)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2000:046. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(61838);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/08/02 13:32:46\");\n\n script_cve_id(\"CVE-2000-0883\");\n script_xref(name:\"MDKSA\", value:\"2000:046\");\n\n script_name(english:\"Mandrake Linux Security Advisory : mod_perl (MDKSA-2000:046)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandrake Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The configuration file, /etc/httpd/conf/addon-modules/mod_perl.conf\ncontained an Options directive that was not entirely secure and\nallowed people to browse the /perl/ directory. This update adds the\n'-Indexes' directive to the Options command, thus making the directory\nnon- browseable.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mod_perl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:mod_perl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:6.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:7.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2000/09/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/09/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK6.1\", cpu:\"i386\", reference:\"mod_perl-1.21-17mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK7.0\", cpu:\"i386\", reference:\"mod_perl-1.21-21mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK7.1\", cpu:\"i386\", reference:\"mod_perl-1.22-29mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "exploitdb": [{"lastseen": "2016-02-02T13:45:17", "bulletinFamily": "exploit", "description": "Mandrake 6.1/7.0/7.1 /perl http Directory Disclosure Vulnerability. CVE-2000-0883. Remote exploit for linux platform", "modified": "2000-09-11T00:00:00", "published": "2000-09-11T00:00:00", "id": "EDB-ID:20220", "href": "https://www.exploit-db.com/exploits/20220/", "type": "exploitdb", "title": "Mandrake 6.1/7.0/7.1 /perl http Directory Disclosure Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/1678/info\r\n\r\nThe default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of the webserver's root tree (the subdirectory tree from which files are accessable on the webserver..) that is used to store perl scripts. In the configuration file for mod_perl, the apache perl interpreter module, the directory is permitted to be \"indexed\".. meaning that the webserver will display the contents of the directory if it is requested by itself. The result is that an attacker can see what files are in /perl. While this bug does not affect how the webserver interprets the files in that directory (eg., it will still execute them), knowing what is there to be executed can allow for more targeted and intelligent attacks against scripts known to be vulnerable listed there.\r\n\r\nPoint your web browser to http://target/perl.", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/20220/"}]}