CVE:CVE-2004-1082
CNNVD:CNNVD-200402-019
Apache是一款流行的WEB服务程序。
Apache mod_digest模块没有充分验证针对用户提供的nonces信息，远程攻击者可以利用这个漏洞可以从其他站点伪造应答信息。
这个漏洞只有在伪造站和服务器上的用户的用户名密码相同，及实际名也相同的情况下产生，不过这种情况比较少。
solution:Upgrade apache http_server to a higher version than 1.3,1.3.1,1.3.3,1.3.4,1.3.6,1.3.7,1.3.9,1.3.11,1.3.12,1.3.14,1.3.17,1.3.18,1.3.19,1.3.20,1.3.22,1.3.23,1.3.24,1.3.25,1.3.26,1.3.27,1.3.28,1.3.29,and avoid the version 1.3,1.3.1,1.3.3,1.3.4,1.3.6,1.3.7,1.3.9,1.3.11,1.3.12,1.3.14,1.3.17,1.3.18,1.3.19,1.3.20,1.3.22,1.3.23,1.3.24,1.3.25,1.3.26,1.3.27,1.3.28,1.3.29; Upgrade apple apache_mod_digest_apple to a higher version than *; Upgrade avaya communication_manager to a higher version than 1.1,1.3.1,2.0,2.0.1,and avoid the version 1.1,1.3.1,2.0,2.0.1; Upgrade avaya intuity_audix_lx to a higher version than *; Upgrade hp virtualvault to a higher version than 4.5,4.6,4.7,and avoid the version 4.5,4.6,4.7; Upgrade hp webproxy to a higher version than a.02.00,a.02.10,and avoid the version a.02.00,a.02.10; Upgrade ibm http_server to a higher version than 1.3.19,and avoid the version 1.3.19; Upgrade avaya mn100 to a higher version than *; Upgrade avaya network_routing to a higher version than *; Upgrade avaya modular_messaging_message_storage_server to a higher version than 1.1,2.0,and avoid the version 1.1,2.0; Upgrade openbsd openbsd to a higher version than 3.4,3.5,current,and avoid the version 3.4,3.5,current; Upgrade sco openserver to a higher version than 5.0.6,5.0.7,and avoid the version 5.0.6,5.0.7; Upgrade sun solaris to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade sun sunos to a higher version than 5.8,and avoid the version 5.8