PT-2013-5739 · Apache+6 · Apache Http Server+6

Publicado 2013-10-19 · Atualizado 2024-06-15 · CVE-2013-5704

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.2.22

Description The mod headers module in the Apache HTTP Server allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. The vendor states that this is not a security issue in httpd as such.

Recommendations For Apache HTTP Server version 2.2.22, consider disabling the mod headers module as a temporary workaround until a patch is available. Restrict access to the trailer portion of data sent with chunked transfer coding to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

ALT-PU-2015-1890

CESA-2015_0325

CESA-2015_1249

CVE-2013-5704

DLA-71-1

HPSBUX03337

HPSBUX03512

OPENSUSE-SU-2024:10268-1

RHSA-2014:1972

RHSA-2015:0325

RHSA-2015:1249

RHSA-2015:2659

RHSA-2015:2660

RHSA-2015_0325

RHSA-2015_1249

RHSA-2016:0061

SUSE-SU-2015:0689-1

SUSE-SU-2015:0974-1

SUSE-SU-2015_0974-1

USN-2523-1

Produtos afetados

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

Ubuntu

Referências · 218

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 http://martin.swende.se/blog/HTTPChunked.html · Exploit
• https://github.com/fatlan/HAProxy-Keepalived-Sec-HighLoads · Nota
• https://rhn.redhat.com/errata/RHSA-2015-0325.html · Nota
• https://bdu.fstec.ru/vul/2022-02640 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E · Nota
• http://openwall.com/lists/oss-security/2015/03/15/6 · Nota
• http://h20565.www2.hpe.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253Demr_na-c04832246%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8142 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253Demr_na-c04686230%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota