CVE-2015-3183
published 2015-07-20CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to…
PriorityP347medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
73.33%
99.4th percentile
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.2.0 < 2.2.31 | 2.2.31 |
| apache | http_server | >= 2.4.0 < 2.4.16 | 2.4.16 |
| apple | os_x_server_v5.0.3 | — | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| debian | apache2 | < apache2 2.4.16-1 (bookworm) | apache2 2.4.16-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability exists in the chunked transfer coding implementation; look for HTTP requests with crafted chunk headers containing large chunk-size values or invalid chunk-extension characters targeting Apache HTTP Server before 2.4.14. ↗
- →Monitor for HTTP request smuggling patterns in traffic between a reverse proxy and Apache httpd, where the proxy and httpd decode chunked encoding differently due to malformed chunk headers. ↗
- ·The vulnerable code is specifically located in modules/http/http_filters.c within Apache HTTP Server; patch or upgrade to 2.4.14 or later to remediate. ↗
- ·Deployments where Apache httpd sits behind an HTTP proxy are at elevated risk, as the smuggling attack relies on differential chunked-encoding parsing between the two components. ↗
- ·Tenable strongly recommends SecurityCenter be installed on a subnet that is not Internet addressable to reduce exposure to this vulnerability. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2015-07-27·CVSS 5.0
CVE-2015-3183 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in the Apache HTTP server.
It was discovered that the Apache HTTP Server incorrectly parsed chunk
headers. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2015-3183)
It was discovered that the Apache HTTP Server incorrectly handled the
ap_some_auth_required API. A remote attacker could possibly use this issue
to bypass intended access restrictions. This issue only affected Ubuntu
14.04 LTS and Ubuntu 15.04. (CVE-2015-3185)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httpd: HTTP request smuggling attack against chunked request parser
vendor_redhat·2015-07-15·CVSS 5.0
CVE-2015-3183 [MEDIUM] CWE-172 httpd: HTTP request smuggling attack against chunked request parser
httpd: HTTP request smuggling attack against chunked request parser
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks.
Package: httpd (CloudForms Management Engine 5) - Affected
Package:
Debian
CVE-2015-3183: apache2 - The chunked transfer coding implementation in the Apache HTTP Server before 2.4....
vendor_debian·2015·CVSS 5.0
CVE-2015-3183 [MEDIUM] CVE-2015-3183: apache2 - The chunked transfer coding implementation in the Apache HTTP Server before 2.4....
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Scope: local
bookworm: resolved (fixed in 2.4.16-1)
bullseye: resolved (fixed in 2.4.16-1)
forky: resolved (fixed in 2.4.16-1)
sid: resolved (fixed in 2.4.16-1)
trixie: resolved (fixed in 2.4.16-1)
Apple
CVE-2015-3183: OS X Server v5.0.3
vendor_apple·CVSS 5.0
CVE-2015-3183 [MEDIUM] CVE-2015-3183: OS X Server v5.0.3
Apple Security Update: About the security content of OS X Server v5.0.3
Product: OS X Server v5.0.3
CVE: CVE-2015-3183
Component: CVE-2015-3183
Apple
CVE-2015-3183: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 5.0
CVE-2015-3183 [MEDIUM] CVE-2015-3183: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-3183
Component: CVE-2015-3183
GHSA
GHSA-892q-vvcr-v6j5: The chunked transfer coding implementation in the Apache HTTP Server before 2
ghsa_unreviewed·2022-05-13
CVE-2015-3183 [MEDIUM] CWE-20 GHSA-892q-vvcr-v6j5: The chunked transfer coding implementation in the Apache HTTP Server before 2
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
OSV
apache2 vulnerabilities
osv·2015-07-27·CVSS 5.0
CVE-2015-3183 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly parsed chunk
headers. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2015-3183)
It was discovered that the Apache HTTP Server incorrectly handled the
ap_some_auth_required API. A remote attacker could possibly use this issue
to bypass intended access restrictions. This issue only affected Ubuntu
14.04 LTS and Ubuntu 15.04. (CVE-2015-3185)
OSV
CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server before 2
osv·2015-07-20·CVSS 5.0
CVE-2015-3183 [MEDIUM] CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server before 2
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
No detection rules found.
No public exploits indexed.
HackerOne
Multiple HTTP Smuggling reports
hackerone·2019-11-12·CVSS 9.8
[CRITICAL] Multiple HTTP Smuggling reports
Multiple HTTP Smuggling reports
Theses reports spreads other several years and are all about **HTTP Smuggling issues**
(HTTP Requests or Responses splitting, Cache Poisoning, Security filter bypass).
I've made reports on a wide range of open source projects, explaining
the (not always easy) problems to the various security maintainers and testing the fixs.
The starting point for this work was the 2005 work published by Amit Klein and some others:
* 2004 - Amit Klein : "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics" https://packetstormsecurity.com/papers/general/whitepaper_httpresponse.pdf
* 2005 - Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin: "HTTP Request Smuggling" https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
* 2006 -
Bugzilla
CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
bugzilla·2015-07-16·CVSS 5.0
CVE-2015-3185 [MEDIUM] CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fe
Bugzilla
CVE-2015-3183 httpd: HTTP request smuggling attack against chunked request parser
bugzilla·2015-07-16·CVSS 5.0
CVE-2015-3183 [MEDIUM] CVE-2015-3183 httpd: HTTP request smuggling attack against chunked request parser
CVE-2015-3183 httpd: HTTP request smuggling attack against chunked request parser
Apache HTTP Server 2.4.16 release fixes the following issue:
*) SECURITY: CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters. [Graham Leggett, Yann Ylavic]
External References:
http://www.apache.org/dist/httpd/CHANGES_2.4.16
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1243894]
---
httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
This
Tenable
[R4] SecurityCenter 5.0.2 Fixes Third-party Library
blogs_tenable·2015-08-20
[R4] SecurityCenter 5.0.2 Fixes Third-party Library
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.htmlhttp://marc.info/?l=bugtraq&m=144493176821532&w=2http://rhn.redhat.com/errata/RHSA-2015-1666.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1667.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1668.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2661.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0062.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2054.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2055.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2056.htmlhttp://www.apache.org/dist/httpd/CHANGES_2.4http://www.debian.org/security/2015/dsa-3325http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlhttp://www.securityfocus.com/bid/75963http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1032967http://www.ubuntu.com/usn/USN-2686-1https://access.redhat.com/errata/RHSA-2015:2659https://access.redhat.com/errata/RHSA-2015:2660https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://puppet.com/security/cve/CVE-2015-3183https://security.gentoo.org/glsa/201610-02https://support.apple.com/HT205219https://support.apple.com/kb/HT205031http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.htmlhttp://marc.info/?l=bugtraq&m=144493176821532&w=2http://rhn.redhat.com/errata/RHSA-2015-1666.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1667.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1668.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2661.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0062.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2054.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2055.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2056.htmlhttp://www.apache.org/dist/httpd/CHANGES_2.4http://www.debian.org/security/2015/dsa-3325http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlhttp://www.securityfocus.com/bid/75963http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1032967http://www.ubuntu.com/usn/USN-2686-1https://access.redhat.com/errata/RHSA-2015:2659https://access.redhat.com/errata/RHSA-2015:2660https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
+ 6 more references
2015-07-20
Published