CVE-2005-2700

Опубликовано: 06 сент. 2005

Источник: nvd

CVSS2: 10

EPSS Низкий

Описание

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Ссылки

http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
Broken Link
http://marc.info/?l=apache-modssl&m=112569517603897&w=2
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=112604765028607&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=112870296926652&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=112870296926652&w=2
Issue Tracking
Mailing List
Third Party Advisory
http://people.apache.org/~jorton/CAN-2005-2700.diff
Vendor Advisory
http://secunia.com/advisories/16700
Not Applicable
http://secunia.com/advisories/16705
Not Applicable
http://secunia.com/advisories/16714
Not Applicable
http://secunia.com/advisories/16743
Not Applicable
http://secunia.com/advisories/16746
Not Applicable
http://secunia.com/advisories/16748
Not Applicable
http://secunia.com/advisories/16753
Not Applicable
http://secunia.com/advisories/16754
Not Applicable
http://secunia.com/advisories/16769
Not Applicable
http://secunia.com/advisories/16771
Not Applicable
http://secunia.com/advisories/16789
Not Applicable
http://secunia.com/advisories/16864
Not Applicable
http://secunia.com/advisories/16956
Not Applicable
http://secunia.com/advisories/17088
Not Applicable

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.0.35 (включая) до 2.0.55 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:4.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:5.04:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.0622

Низкий

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2005-2700

ubuntu

около 20 лет назад

CVE-2005-2700

redhat

около 20 лет назад

CVE-2005-2700

debian

около 20 лет назад

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyCli ...

GHSA-6h5v-qgqr-fmq8

github

больше 3 лет назад

EPSS

Процентиль: 91%

0.0622

Низкий

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo