cbcvebase.
CVE-2006-3918
published 2006-07-28

CVE-2006-3918: http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2…

PriorityP428medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
94.93%
99.9th percentile
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server

Detection & IOCsextracted from sources · hover to see the quote

otherExpect: <script>alert('gotcha!')</script>
pathhttp_protocol.c
  • Detect HTTP requests containing a malicious payload in the 'Expect' request header — the unsanitized value is reflected verbatim in Apache/IBM HTTP Server error responses, enabling XSS.
  • Monitor for Flash SWF files (ActionScript LoadVars) sending HTTP requests with crafted 'Expect' headers containing script content to Apache endpoints — this is the demonstrated attack delivery mechanism.
  • Alert on HTTP responses from Apache/IBM HTTP Server that echo back the contents of the 'Expect' request header unescaped in error message bodies (HTTP 4xx responses).
  • Use the Google dork 'allintitle:"Oracle HTTP Server -"' to identify potentially vulnerable Oracle HTTP Server 10g instances exposed on the internet.
  • ·The vulnerability is fixed in Apache HTTP Server 1.3.35, 2.0.58, and 2.2.2 — versions prior to these thresholds in each branch are vulnerable.
  • ·IBM HTTP Server is also affected: versions 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1 are vulnerable.
  • ·Oracle HTTP Server 10g (10.1.2.0.2), based on Apache 1.3, is vulnerable; upgrading to OHS 11g (based on Apache 2.2) is the recommended remediation path. Apache security patches should NOT be applied directly to OHS 10g.
  • ·Exploitation requires a client (e.g., Flash SWF) capable of sending arbitrary HTTP headers; standard browsers alone are insufficient for exploitation.

CVSS provenance

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.