PT-2008-1681 · Apache+1 · Apache+2

Published 2008-01-08 · Updated 2024-06-15 · CVE-2008-0005

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache versions 1.3.x before 1.3.40-dev Apache versions 2.0.x before 2.0.62-dev Apache versions 2.2.x before 2.2.7-dev

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding because mod proxy ftp does not define a charset. This can be exploited against Web browsers that do not correctly derive the response character set following the rules in RFC 2616.

Recommendations For Apache versions 1.3.x before 1.3.40-dev, update to version 1.3.40-dev or later to resolve the issue. For Apache versions 2.0.x before 2.0.62-dev, update to version 2.0.62-dev or later to resolve the issue. For Apache versions 2.2.x before 2.2.7-dev, update to version 2.2.7-dev or later to resolve the issue. As a temporary workaround, consider disabling the mod proxy ftp module on sites where it is enabled and a forward proxy is configured to minimize the risk of cross-site scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0005

HPSBUX02431

HPSBUX02465

OPENSUSE-SU-2024:10623-1

RHSA-2008:0004

RHSA-2008:0005

RHSA-2008:0006

RHSA-2008:0007

RHSA-2008:0008

RHSA-2008:0009

RHSA-2008_0006

RHSA-2008_0008

RHSA-2010:0602

Affected Products

Apache

Apache Http Server

Red Hat

References · 142

• 🔥 http://securityreason.com/achievement_securityalert/49 · Exploit
• 🔥 http://securityreason.com/securityalert/3526 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2371 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2829 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00562.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://ubuntu.com/usn/usn-575-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2666 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0006.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2665 · Security Note