CVE-2005-2088 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2005-2088
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2005-2088

Description: The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

CVE Status: Candidate

References: UBUNTU http://www.ubuntu.com/usn/usn-160-2 TRUSTIX http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html SUSE http://www.novell.com/linux/security/advisories/2005_18_sr.html http://www.novell.com/linux/security/advisories/2005_46_apache.html SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 ST 1014323 SREASON http://securityreason.com/securityalert/604 SLACKWARE http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000 SAID Secunia Advisory: SA23074 Secunia Advisory: SA19185 Secunia Advisory: SA14530 Secunia Advisory: SA17487 Secunia Advisory: SA17319 Secunia Advisory: SA19317 Secunia Advisory: SA19072 Secunia Advisory: SA19073 Secunia Advisory: SA17813 REDHAT http://www.redhat.com/support/errata/RHSA-2005-582.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1629 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1237 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1526 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:840 MLIST http://marc2.theaimsgroup.com/?l=apache-httpd-announce&m=112931556417329&w=3 MISC http://www.securiteam.com/securityreviews/5GP0220G0U.html http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf MANDRIVA http://frontal2.mandriva.com/security/advisories?name=MDKSA-2005:130 HP http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828 http://www.securityfocus.com/archive/1/archive/1/428138/100/0/threaded DEBIAN http://www.debian.org/security/2005/dsa-805 http://www.debian.org/security/2005/dsa-803 CONFIRM http://www.apache.org/dist/httpd/CHANGES_1.3 http://www.apache.org/dist/httpd/CHANGES_2.0 http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm BUGTRAQ http://seclists.org/lists/bugtraq/2005/Jun/0025.html BID 14106 15647 APPLE http://docs.info.apple.com/article.html?artnum=302847 AIXAPAR http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only

Return to the previous page.