PT-2005-1052 · Apsis · Pound

Publicado

2005-05-03

·

Atualizado

2008-09-05

·

CVE-2005-3751

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Pound versions prior to 1.9.4
Description The issue allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers. Multiple vulnerabilities in the Pound package may lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.
Recommendations For versions prior to 1.9.4, update to version 1.9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP requests with conflicting Content-length and Transfer-encoding headers to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

BDU:2015-04024
CVE-2005-3751
DSA-934-1

Produtos afetados

Pound