CVE-2006-3918
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 95.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 95.10% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- apache/http server · debian/debian linux · canonical/ubuntu linux · redhat/enterprise linux server · redhat/enterprise linux workstation
- Source
- cve@mitre.org
References
- ftp://patches.sgi.com/support/free/security/advisories/20060801-01-PBroken Link
- http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.htmlBroken Link, Exploit
- http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.htmlBroken Link, Exploit
- http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=125631037611762&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=129190899612998&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=130497311408250&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://openbsd.org/errata.html#httpd2Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2006-0618.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2006-0692.htmlThird Party Advisory
- http://secunia.com/advisories/21172Not Applicable, Patch, Vendor Advisory
- http://secunia.com/advisories/21174Not Applicable, Patch, Vendor Advisory
- http://secunia.com/advisories/21399Not Applicable
- http://secunia.com/advisories/21478Not Applicable
- http://secunia.com/advisories/21598Not Applicable
- http://secunia.com/advisories/21744Not Applicable
- http://secunia.com/advisories/21848Not Applicable
- http://secunia.com/advisories/21986Not Applicable
- http://secunia.com/advisories/22140Not Applicable
- http://secunia.com/advisories/22317Not Applicable
- http://secunia.com/advisories/22523Not Applicable
- http://secunia.com/advisories/28749Not Applicable
- http://secunia.com/advisories/29640Not Applicable
- http://secunia.com/advisories/40256Not Applicable
- http://securityreason.com/securityalert/1294Exploit, Third Party Advisory
- http://securitytracker.com/id?1016569Broken Link, Third Party Advisory, VDB Entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-194.htmThird Party Advisory
- http://svn.apache.org/viewvc?view=rev&revision=394965Exploit, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.