PT-2005-1052 · Apsis · Pound

Published 2005-05-03 · Updated 2008-09-05 · CVE-2005-3751

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pound versions prior to 1.9.4

Description The issue allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers. Multiple vulnerabilities in the Pound package may lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions prior to 1.9.4, update to version 1.9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP requests with conflicting Content-length and Transfer-encoding headers to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-04024

CVE-2005-3751

DSA-934-1

Affected Products

Pound

References · 16

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1391 · Security Note
• http://secunia.com/advisories/20215 · Vendor Advisory
• http://secunia.com/advisories/20510 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3751 · Security Note
• http://debian.org/security/2005/dsa-934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3751 · Security Note
• http://secunia.com/advisories/18367 · Vendor Advisory
• http://secunia.com/advisories/18381 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-3751 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3751 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-3751 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04024 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200606-05.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_05_19.html · Vendor Advisory
• http://apsis.ch/pound/pound_list/archive/2005/2005-10/1129827166000/index_html?fullMode=1#1129827166000 · Note