Read the docs
TI-2004-00979 Aliases CVE-2004-1082GHSA-hhpf-qqgg-4c2j

mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify…

Priority MEDIUM 43Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

Why it matters now

EPSS 0.07583 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableApache
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableApache
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableApache
cpe:2.3:a:apache:http_server:1.3.7:*:dev:*:*:*:*:*1.3.7VulnerableApache
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableApache
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*1.3.11VulnerableApache
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*1.3.12VulnerableApache
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*1.3.14VulnerableApache
  • cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.7:*:dev:*:*:*:*:* Versions 1.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:* Versions 1.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:* Versions 1.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:* Versions 1.3.14 Vulnerable ·Apache
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*1.3.17VulnerableApache
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*1.3.18VulnerableApache
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*1.3.19VulnerableApache
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*1.3.20VulnerableApache
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*1.3.22VulnerableApache
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*1.3.23VulnerableApache
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*1.3.24VulnerableApache
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*1.3.25VulnerableApache
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*1.3.26VulnerableApache
cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*1.3.27VulnerableApache
cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*1.3.28VulnerableApache
cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*1.3.29VulnerableApache
cpe:2.3:a:apple:apache_mod_digest_apple:*:*:*:*:*:*:*:*all versionsVulnerableApple
cpe:2.3:a:avaya:communication_manager:1.1:*:*:*:*:*:*:*1.1VulnerableAvaya
cpe:2.3:a:avaya:communication_manager:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableAvaya
cpe:2.3:a:avaya:communication_manager:2.0:*:*:*:*:*:*:*2.0VulnerableAvaya
cpe:2.3:a:avaya:communication_manager:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableAvaya
cpe:2.3:a:avaya:intuity_audix_lx:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:hp:virtualvault:4.5:*:*:*:*:*:*:*4.5VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:virtualvault:4.6:*:*:*:*:*:*:*4.6VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:virtualvault:4.7:*:*:*:*:*:*:*4.7VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:webproxy:a.02.00:*:*:*:*:*:*:*a.02.00VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:webproxy:a.02.10:*:*:*:*:*:*:*a.02.10VulnerableHewlett Packard Enterprise
cpe:2.3:a:ibm:http_server:1.3.19:*:*:*:*:*:*:*1.3.19VulnerableIBM
cpe:2.3:a:avaya:mn100:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:avaya:network_routing:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:o:avaya:modular_messaging_message_storage_server:1.1:*:*:*:*:*:*:*1.1VulnerableAvaya
cpe:2.3:o:avaya:modular_messaging_message_storage_server:2.0:*:*:*:*:*:*:*2.0VulnerableAvaya
cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:*3.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:*3.5VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:current:*:*:*:*:*:*:*currentVulnerableOpenBSD
cpe:2.3:o:sco:openserver:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableSco
cpe:2.3:o:sco:openserver:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableSco
cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*8.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*5.8VulnerableSun
  • cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:* Versions 1.3.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:* Versions 1.3.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:* Versions 1.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:* Versions 1.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:* Versions 1.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:* Versions 1.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:* Versions 1.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:* Versions 1.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:* Versions 1.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:* Versions 1.3.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:* Versions 1.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:* Versions 1.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apple:apache_mod_digest_apple:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apple
  • cpe:2.3:a:avaya:communication_manager:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:communication_manager:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:communication_manager:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:communication_manager:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:intuity_audix_lx:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:hp:virtualvault:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:virtualvault:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:virtualvault:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:webproxy:a.02.00:*:*:*:*:*:*:* Versions a.02.00 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:webproxy:a.02.10:*:*:*:*:*:*:* Versions a.02.10 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:ibm:http_server:1.3.19:*:*:*:*:*:*:* Versions 1.3.19 Vulnerable ·IBM
  • cpe:2.3:a:avaya:mn100:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:avaya:network_routing:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:o:avaya:modular_messaging_message_storage_server:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Avaya
  • cpe:2.3:o:avaya:modular_messaging_message_storage_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Avaya
  • cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:current:*:*:*:*:*:*:* Versions current Vulnerable ·OpenBSD
  • cpe:2.3:o:sco:openserver:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Sco
  • cpe:2.3:o:sco:openserver:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Sco
  • cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:* Versions 8.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Sun

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1082
  2. 2026-10-03 Alias added: GHSA-hhpf-qqgg-4c2j

References

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences