CVE-2005-2700 — Apache Http Server vulnerability

10 documents9 sources
Severity
10.0CRITICALNVD
EPSS
15.1%
top 5.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apache Http ServerCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedSep 6
Latest updateMay 1

Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDapache/http_server2.0.35 — 2.0.55

Also affects: Debian Linux 3.0, 3.1, Ubuntu Linux 4.10, 5.04

🔴Vulnerability Details

3
GHSA
GHSA-6h5v-qgqr-fmq8: ssl_engine_kernel↗2022-05-01
▶
OSV
CVE-2005-2700: ssl_engine_kernel↗2005-09-06
▶
CVEList
CVE-2005-2700: ssl_engine_kernel↗2005-09-06
▶

💥Exploits & PoCs

1
Exploit-DB
Asus VideoSecurity Online 3.5 - Web Server Authentication Buffer Overflow↗2005-11-02
▶

📋Vendor Advisories

3
Ubuntu
Apache 2 vulnerabilities↗2005-09-07
▶
Red Hat
security flaw↗2005-08-30
▶
Debian
CVE-2005-2700: apache2 - ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient option...↗2005
▶

💬Community

2
Bugzilla
CVE-2005-2700 security flaw↗2018-08-16
▶
Bugzilla
CVE-2004-0488 mod_ssl flaws (CVE-2004-0885 CVE-2005-2700)↗2005-10-25
▶
CVE-2005-2700 — Apache Http Server vulnerability | cvebase