CVE-2008-0456
CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
- EPSS
- 19.04% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- apache/http server · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlBroken Link, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0130.htmlThird Party Advisory
- http://secunia.com/advisories/29348Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35074Not Applicable, Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200803-19.xmlThird Party Advisory
- http://securityreason.com/securityalert/3575Exploit, Third Party Advisory
- http://securitytracker.com/id?1019256Broken Link, Third Party Advisory, VDB Entry
- http://support.apple.com/kb/HT3549Third Party Advisory
- http://www.mindedsecurity.com/MSA01150108.htmlBroken Link
- http://www.securityfocus.com/archive/1/486847/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/27409Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2009/1297Permissions Required, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39893Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlBroken Link, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0130.htmlThird Party Advisory
- http://secunia.com/advisories/29348Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35074Not Applicable, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.