PT-2005-3031 · Microsoft · Iis

Ory Segal · Published 2005-06-30 · Updated 2024-02-09 · CVE-2005-2089

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft IIS versions 5.0 through 6.0

Description: The issue allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a Transfer-Encoding: chunked header and a Content-Length header. This causes the server to incorrectly handle and forward the body of the request, resulting in the receiving server processing it as a separate HTTP request, also known as "HTTP Request Smuggling."

Recommendations: For Microsoft IIS versions 5.0 through 6.0, consider disabling the handling of HTTP requests with both Transfer-Encoding: chunked and Content-Length headers as a temporary workaround until a patch is available. Restrict access to sensitive web application areas to minimize the risk of exploitation. Avoid using vulnerable configurations that allow for web cache poisoning and XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2005-2089

Affected Products

Iis

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-2089 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42899 · Note
• http://securiteam.com/securityreviews/5GP0220G0U.html · Note
• http://seclists.org/lists/bugtraq/2005/Jun/0025.html · Note
• http://watchfire.com/resources/HTTP-Request-Smuggling.pdf · Note
• https://t.me/cvenotify/70728 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2089 · Note