Vulnerability CVE-2006-3918

Vulnerability CVE-2006-3918

Published: 2006-07-27 Modified: 2012-02-12

Description:

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Write-up by Amit Klein: \"Forging HTTP request headers with Flash\"	Amit Klein (AKse...	01.08.2006

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
IBM -> Http server
Apache -> Http server

References:

http://secunia.com/advisories/21174

http://secunia.com/advisories/21172

http://www.vupen.com/english/advisories/2010/1572

http://www.vupen.com/english/advisories/2006/5089

http://www.vupen.com/english/advisories/2006/4207

http://www.vupen.com/english/advisories/2006/3264

http://www.vupen.com/english/advisories/2006/2964

http://www.vupen.com/english/advisories/2006/2963

http://www.securitytracker.com/id?1024144

http://www.redhat.com/support/errata/RHSA-2006-0619.html

http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html

http://www-1.ibm.com/support/docview.wss?uid=swg24013080

http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631

http://svn.apache.org/viewvc?view=rev&revision=394965

http://securitytracker.com/id?1016569

http://secunia.com/advisories/40256

http://secunia.com/advisories/21478

http://secunia.com/advisories/21399

http://rhn.redhat.com/errata/RHSA-2006-0618.html

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12238

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10352

http://marc.info/?l=bugtraq&m=130497311408250&w=2

http://marc.info/?l=bugtraq&m=129190899612998&w=2

http://marc.info/?l=bugtraq&m=125631037611762&w=2

http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html

http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117

http://www.ubuntu.com/usn/usn-575-1

http://www.securityfocus.com/bid/19661

http://www.novell.com/linux/security/advisories/2006_51_apache.html

http://www.debian.org/security/2006/dsa-1167

http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm

http://securityreason.com/securityalert/1294

http://secunia.com/advisories/29640

http://secunia.com/advisories/28749

http://secunia.com/advisories/22523

http://secunia.com/advisories/22317

http://secunia.com/advisories/22140

http://secunia.com/advisories/21986

http://secunia.com/advisories/21848

http://secunia.com/advisories/21744

http://secunia.com/advisories/21598

http://rhn.redhat.com/errata/RHSA-2006-0692.html

http://openbsd.org/errata.html#httpd2

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P

Vulnerability CVE-2006-3918

See advisories in our WLB2 database:

Med.

Write-up by Amit Klein: \"Forging HTTP request headers with Flash\"

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

4.3/10

2.9/10

8.6/10

Remote

Medium

No required

None

Partial

None

Affected software

References: