PT-2005-2106 · An · An Httpd Server+1

Published 2005-04-07 · Updated 2017-07-11 · CVE-2005-1087

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions AN HTTPD Server version 1.42n

Description The issue allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request. This is due to a CRLF injection vulnerability in the cmdIS.DLL plugin.

Recommendations For AN HTTPD Server version 1.42n, update the cmdIS.DLL plugin to a version that fixes the CRLF injection vulnerability. As a temporary workaround, consider restricting access to the HTTP server to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1087

Affected Products

An Httpd Server

Cmdis.Dll

References · 7

• 🔥 https://exploit-db.com/exploits/25365 · Exploit
• http://securitytracker.com/id?1013666 · Vendor Advisory
• http://osvdb.org/15362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1087 · Security Note
• http://security.org.sg/vuln/anhttpd142n.html · Vendor Advisory
• http://secunia.com/advisories/14861 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20031 · Note