CVE-2005-2088
published 2005-07-05CVE-2005-2088: The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web…
PriorityP425medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
20.46%
97.2th percentile
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.0.35 < 2.0.55 | 2.0.55 |
| debian | apache2 | < apache2 2.0.54-5 (bookworm) | apache2 2.0.54-5 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache 2 vulnerabilities
vendor_ubuntu·2005-08-04
CVE-2005-1268 Apache 2 vulnerabilities
Title: Apache 2 vulnerabilities
Summary: Apache 2 vulnerabilities
Marc Stern discovered a buffer overflow in the SSL module's
certificate revocation list (CRL) handler. If Apache is configured to
use a malicious CRL, this could possibly lead to a server crash or
arbitrary code execution with the privileges of the Apache web server.
(CAN-2005-1268)
Watchfire discovered that Apache insufficiently verified the
"Transfer-Encoding" and "Content-Length" headers when acting as an
HTTP proxy. By sending a specially crafted HTTP request, a remote
attacker who is authorized to use the proxy could exploit this to
bypass web application firewalls, poison the HTTP proxy cache, and
conduct cross-site scripting attacks against other proxy users.
(CAN-2005-2088)
Instructions: In general, a standard sy
Red Hat
security flaw
vendor_redhat·2005-06-12·CVSS 4.3
CVE-2005-2088 [MEDIUM] security flaw
security flaw
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Debian
CVE-2005-2088: apache2 - The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an...
vendor_debian·2005·CVSS 4.3
CVE-2005-2088 [MEDIUM] CVE-2005-2088: apache2 - The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an...
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Scope: local
bookworm: resolved (fixed in 2.0.54-5)
bullseye: resolved (fixed in 2.0.54-5)
forky: resolved (fixed in 2.0.54-5)
sid: resolved (fixed in 2.0.54-5)
trixie: resolved (fixed in 2.0.54-5)
GHSA
GHSA-vq42-chwj-gj93: The Apache HTTP server before 1
ghsa_unreviewed·2022-05-01
CVE-2005-2088 [MEDIUM] CWE-444 GHSA-vq42-chwj-gj93: The Apache HTTP server before 1
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
OSV
CVE-2005-2088: The Apache HTTP server before 1
osv·2005-07-05·CVSS 4.3
CVE-2005-2088 [MEDIUM] CVE-2005-2088: The Apache HTTP server before 1
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
No detection rules found.
No public exploits indexed.
CAPEC
HTTP Request Smuggling
mitre_capec
[HIGH] HTTP Request Smuggling
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.
Alternate Terms: HTTP Desync
Execution Flow:
Step 1 [Explore]: [Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing
CWE
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
mitre_cwe
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
(such as a proxy or firewall) in the data flow between two
entities such as a client and server, but it does not
interpret malformed HTTP requests or responses in ways that
are consistent with how the messages will be processed by
those entities that are at the ultimate destination.
HTTP requests or responses ("messages") can be
malformed or unexpected in ways that cause web servers or
clients to interpret the messages in different ways than
intermediary HTTP agents such as load balancers, reverse
proxies, web caching proxies, application firewalls,
etc. For example, an adversary may be able to add duplicate
or different header fields that a client or s
http://docs.info.apple.com/article.html?artnum=302847http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.htmlhttp://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3http://seclists.org/lists/bugtraq/2005/Jun/0025.htmlhttp://secunia.com/advisories/14530http://secunia.com/advisories/17319http://secunia.com/advisories/17487http://secunia.com/advisories/17813http://secunia.com/advisories/19072http://secunia.com/advisories/19073http://secunia.com/advisories/19185http://secunia.com/advisories/19317http://secunia.com/advisories/23074http://securityreason.com/securityalert/604http://securitytracker.com/id?1014323http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1http://support.avaya.com/elmodocs2/security/ASA-2006-081.htmhttp://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=onlyhttp://www.apache.org/dist/httpd/CHANGES_1.3http://www.apache.org/dist/httpd/CHANGES_2.0http://www.debian.org/security/2005/dsa-803http://www.debian.org/security/2005/dsa-805http://www.mandriva.com/security/advisories?name=MDKSA-2005:130http://www.novell.com/linux/security/advisories/2005_18_sr.htmlhttp://www.novell.com/linux/security/advisories/2005_46_apache.htmlhttp://www.redhat.com/support/errata/RHSA-2005-582.htmlhttp://www.securiteam.com/securityreviews/5GP0220G0U.htmlhttp://www.securityfocus.com/archive/1/428138/100/0/threadedhttp://www.securityfocus.com/bid/14106http://www.securityfocus.com/bid/15647http://www.ubuntu.com/usn/usn-160-2http://www.vupen.com/english/advisories/2005/2140http://www.vupen.com/english/advisories/2005/2659http://www.vupen.com/english/advisories/2006/0789http://www.vupen.com/english/advisories/2006/1018http://www.vupen.com/english/advisories/2006/4680http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdfhttp://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11452https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1237https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1526https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1629https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.htmlhttp://docs.info.apple.com/article.html?artnum=302847http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.htmlhttp://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3http://seclists.org/lists/bugtraq/2005/Jun/0025.htmlhttp://secunia.com/advisories/14530http://secunia.com/advisories/17319http://secunia.com/advisories/17487http://secunia.com/advisories/17813http://secunia.com/advisories/19072http://secunia.com/advisories/19073http://secunia.com/advisories/19185http://secunia.com/advisories/19317http://secunia.com/advisories/23074http://securityreason.com/securityalert/604http://securitytracker.com/id?1014323http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1http://support.avaya.com/elmodocs2/security/ASA-2006-081.htmhttp://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=onlyhttp://www.apache.org/dist/httpd/CHANGES_1.3http://www.apache.org/dist/httpd/CHANGES_2.0http://www.debian.org/security/2005/dsa-803http://www.debian.org/security/2005/dsa-805http://www.mandriva.com/security/advisories?name=MDKSA-2005:130http://www.novell.com/linux/security/advisories/2005_18_sr.htmlhttp://www.novell.com/linux/security/advisories/2005_46_apache.htmlhttp://www.redhat.com/support/errata/RHSA-2005-582.htmlhttp://www.securiteam.com/securityreviews/5GP0220G0U.htmlhttp://www.securityfocus.com/archive/1/428138/100/0/threadedhttp://www.securityfocus.com/bid/14106http://www.securityfocus.com/bid/15647http://www.ubuntu.com/usn/usn-160-2http://www.vupen.com/english/advisories/2005/2140http://www.vupen.com/english/advisories/2005/2659http://www.vupen.com/english/advisories/2006/0789http://www.vupen.com/english/advisories/2006/1018http://www.vupen.com/english/advisories/2006/4680http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdfhttp://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828
+ 18 more references
2005-07-05
Published