Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2013-5704

Опубликовано: 19 окт. 2013
Источник: redhat
CVSS2: 4.3
EPSS Высокий

Описание

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.

Отчет

This issue affects the versions of the httpd package as shipped with Red Hat JBoss Enterprise Application Platform 6; and Red Hat JBoss Web Server 2. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Red Hat Certificate System does not use the mod_headers module, even when installed, and is thus not affected by this flaw. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. Red Hat JBoss Enterprise Application Platform 5 and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Directory Server 8httpdWill not fix
Red Hat Enterprise Linux 5httpdWill not fix
Red Hat JBoss Enterprise Application Platform 5httpdWill not fix
Red Hat JBoss Enterprise Application Platform 6httpdFix deferred
Red Hat JBoss Enterprise Web Server 1httpdWill not fix
Red Hat Enterprise Linux 6httpdFixedRHSA-2015:124920.07.2015
Red Hat Enterprise Linux 7httpdFixedRHSA-2015:032505.03.2015
Red Hat JBoss Enterprise Web Server 2 for RHEL 5httpdFixedRHSA-2016:006121.01.2016
Red Hat JBoss Enterprise Web Server 2 for RHEL 5mod_cluster-nativeFixedRHSA-2016:006121.01.2016
Red Hat JBoss Enterprise Web Server 2 for RHEL 6httpdFixedRHSA-2016:006121.01.2016

Показывать по

Дополнительная информация

Статус:

Low
Дефект:
CWE-287
https://bugzilla.redhat.com/show_bug.cgi?id=1082903httpd: bypass of mod_headers rules via chunked requests

EPSS

Процентиль: 99%
0.8313
Высокий

4.3 Medium

CVSS2

Связанные уязвимости

ubuntu
больше 11 лет назад

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

nvd
больше 11 лет назад

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

debian
больше 11 лет назад

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote ...

github
больше 3 лет назад

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

oracle-oval
около 10 лет назад

ELSA-2015-1249: httpd security, bug fix, and enhancement update (LOW)

EPSS

Процентиль: 99%
0.8313
Высокий

4.3 Medium

CVSS2