Vulnerability CVE-2005-2088

Vulnerability CVE-2005-2088

Published: 2005-07-05 Modified: 2012-02-12

Description:

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Apache-based Web Server on HP-UX mod_ssl, proxy_http, Remote Execution of Arbitrary Code, Denial of Service (DoS), and Unauthori	security-alert h...	20.03.2006

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Apache -> Http server

References:

http://docs.info.apple.com/article.html?artnum=302847

http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

http://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3

http://seclists.org/lists/bugtraq/2005/Jun/0025.html

http://securityreason.com/securityalert/604

http://securitytracker.com/id?1014323

http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1

http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only

http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only

http://www.apache.org/dist/httpd/CHANGES_1.3

http://www.apache.org/dist/httpd/CHANGES_2.0

http://www.debian.org/security/2005/dsa-803

http://www.debian.org/security/2005/dsa-805

http://www.mandriva.com/security/advisories?name=MDKSA-2005:130

http://www.novell.com/linux/security/advisories/2005_18_sr.html

http://www.novell.com/linux/security/advisories/2005_46_apache.html

http://www.redhat.com/support/errata/RHSA-2005-582.html

http://www.securiteam.com/securityreviews/5GP0220G0U.html

http://www.securityfocus.com/archive/1/428138/100/0/threaded

http://www.securityfocus.com/bid/14106

http://www.securityfocus.com/bid/15647

http://www.ubuntu.com/usn/usn-160-2

http://www.vupen.com/english/advisories/2005/2140

http://www.vupen.com/english/advisories/2005/2659

http://www.vupen.com/english/advisories/2006/0789

http://www.vupen.com/english/advisories/2006/1018

http://www.vupen.com/english/advisories/2006/4680

http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf

http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11452

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1237

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1526

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1629

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840

https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.html

Vulnerability CVE-2005-2088

See advisories in our WLB2 database:

Med.

Apache-based Web Server on HP-UX mod_ssl, proxy_http, Remote Execution of Arbitrary Code, Denial of Service (DoS), and Unauthori

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

4.3/10

2.9/10

8.6/10

Remote

Medium

No required

None

Partial

None

Affected software

References: