FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

apache -- http request smuggling

Affected packages
apache < 1.3.33_2
2.* < apache < 2.0.54_1
2.1.0 < apache < 2.1.6_1
apache+ssl < 1.3.33.1.55_1
apache+mod_perl < 1.3.33_3
apache+mod_ssl < 1.3.33+2.8.22_1
apache+mod_ssl+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_accel < 1.3.33+2.8.22_1
apache+mod_ssl+mod_accel+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_accel+mod_deflate < 1.3.33+2.8.22_1
apache+mod_ssl+mod_accel+mod_deflate+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_deflate < 1.3.33+2.8.22_1
apache+mod_ssl+mod_deflate+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp+mod_accel < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp+mod_accel+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp+mod_deflate < 1.3.33+2.8.22_1
apache+mod_ssl+mod_snmp+mod_deflate+ipv6 < 1.3.33+2.8.22_1
0 < apache_fp
apache+ipv6 < 1.3.37
ru-apache < 1.3.34+30.22
ru-apache+mod_ssl < 1.3.34+30.22+2.8.25

Details

VuXML ID 651996e0-fe07-11d9-8329-000e0c2e438a
Discovery 2005-07-25
Entry 2005-07-26
Modified 2009-01-23

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this vulnerability requires multiple carefully crafted HTTP requests, taking advantage of an caching server, proxy server, web application firewall etc. This only affects installations where Apache is used as HTTP proxy in combination with the following web servers:

References

Bugtraq ID 14106
CVE Name CVE-2005-2088
URL http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.