PT-2008-2314 · Ibm · Http Server+1

Published 2008-02-12 · Updated 2011-03-08 · CVE-2008-0694

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM OS/400 versions V5R3M0 through V5R4M0

Description A cross-site scripting issue exists due to improper handling of the Expect HTTP header in the HTTP Server, allowing remote attackers to inject arbitrary web script or HTML.

Recommendations For IBM OS/400 versions V5R3M0 through V5R4M0, consider restricting access to the HTTP Server until a fix is available. As a temporary workaround, disabling the Expect HTTP header may help minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0694

Affected Products

Http Server

Ibm Os/400

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-0694 · Security Note
• http://secunia.com/advisories/28744 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=nas22f5a0f082f6821c4862573e10041f7bd · Vendor Advisory
• http://vupen.com/english/advisories/2008/0397 · Note
• http://securityfocus.com/bid/27595 · Note