PT-2005-3030 · Apache+2 · Apache Http Server+2

Published 2005-06-11 · Updated 2024-02-09 · CVE-2005-2088

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache HTTP server versions 1.3.x through 1.3.33 Apache HTTP server versions 2.0.x through 2.0.54

Description: A flaw occurs when using the Apache server as an HTTP proxy. A remote attacker could send an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, causing Apache to incorrectly handle and forward the body of the request. This could allow the bypass of web application firewall protection or lead to cross-site scripting (XSS) attacks.

Recommendations: For Apache HTTP server versions 1.3.x through 1.3.33, update to version 1.3.34 or later. For Apache HTTP server versions 2.0.x through 2.0.54, update to version 2.0.55 or later. As a temporary workaround, consider disabling the HTTP proxy functionality until a patch is available. Restrict access to the HTTP proxy module to minimize the risk of exploitation.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2005-2088

DSA-803-1

DSA-805-1

HPSBUX02101

RHSA-2005:582

RHSA-2005_582

Affected Products

Apache Http Server

Hp-Ux

Red Hat

References · 72

• 🔥 http://securiteam.com/securityreviews/5GP0220G0U.html · Exploit
• 🔥 http://securityreason.com/securityalert/604 · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 · Vendor Advisory
• http://debian.org/security/2005/dsa-803 · Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=302847 · Vendor Advisory
• http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:130 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_18_sr.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-2088 · Vendor Advisory
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only · Vendor Advisory
• https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• http://apache.org/dist/httpd/CHANGES_2.0 · Vendor Advisory
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory