search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Apache HTTP Server on Win32 systems does not securely handle input passed to CGI programs

Vulnerability Note VU#124003

Original Release Date: 2002-04-11 | Last Revised: 2002-05-28


A vulnerability in the Apache HTTP Server running on Win32 systems (Windows 9x/Me, Windows NT/2000/XP) could allow an attacker to execute commands with the privileges of the web server process.


The Apache HTTP Server is a freely available web server that runs on a variety of operating systems including Unix, Linux, and Microsoft Windows (Win32). Apache supports the Common Gateway Interface (CGI) that defines a standard interface between the HTTP server and external applications. On Win32 systems, batch or command shell programs (files typically with .bat or .cmd extensions) can be executed via the CGI interface, and these programs are executed within a full command shell ( on Windows 9x/Me, cmd.exe in Windows NT/2000/XP).

Ory Segal of Sanctum has reported a vulnerability in which Apache on Win32 does not securely handle the arguments passed to batch or command shell CGI programs. By crafting a CGI request containing the "|" (pipe) character, an attacker can cause the program to execute arbitrary commands with the privileges of the Apache process. By default, Apache is installed with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, all programs including Apache run with full privileges.


An unauthenticated, remote attacker could execute commands on the vulnerable server with the privileges of the Apache process. By default, Apache runs with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, Apache runs with full privileges.


Upgrade Apache
This vulnerability is resolved in Apache 1.3.24 and 2.0.34-beta. Please see the release Announcement for version 1.3.24. The Apache HTTP Server is available from the Apache web site.

Run Apache with User privileges

On Windows NT, 2000, and XP systems, the Apache service can be configured to run as a specified user instead of local SYSTEM. By carefully specifying the privileges of the Apache user, an administrator can restrict the ability of a CGI program to access files and execute commands.

Vendor Information


Apache Affected

Notified:  April 08, 2002 Updated: April 11, 2002



Vendor Statement

Apache has released versions 1.3.24 and 2.0.34-beta that address this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has verified this vulnerability on Apache 1.3.23 running on Windows 2000.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



The CERT/CC acknowledges Ory Segal for reporting this vulnerability.

This document was written by Art Manion.

Other Information

CVE IDs: CVE-2002-0061
Severity Metric: 11.06
Date Public: 2002-03-21
Date First Published: 2002-04-11
Date Last Updated: 2002-05-28 23:10 UTC
Document Revision: 18

Sponsored by CISA.