CVE-2001-1534

Name	CVE-2001-1534
Description	mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low (attack range: local)
Debian Bugs	328919

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apache2 (PTS)	jessie	2.4.10-10+deb8u12	vulnerable
	jessie (security)	2.4.10-10+deb8u13	vulnerable
	stretch	2.4.25-3+deb9u6	vulnerable
	stretch (security)	2.4.25-3+deb9u4	vulnerable
	buster, sid	2.4.38-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
apache	source	(unstable)	(unfixed)	unimportant		328919
apache2	source	(unstable)	(unfixed)	unimportant

Cookies are only used for invading user privacy,
not for authentication, so apache and apache2 should be fine.