// For flags

CVE-2005-2088

Ubuntu Security Notice 160-1

Severity Score

7.2
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Multiple vulnerabilities exist in Apache 2.x. Marc Stern discovered a buffer overflow in the SSL module's certificate revocation list (CRL) handler. Watchfire discovered that Apache insufficiently verified the Transfer-Encoding and Content-Length headers when acting as an HTTP proxy.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2005-06-30 CVE Reserved
  • 2005-06-30 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • 2025-08-04 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CAPEC
References (56)
URL Tag Source
http://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3 Mailing List
http://seclists.org/lists/bugtraq/2005/Jun/0025.html Issue Tracking
http://secunia.com/advisories/14530 Not Applicable
http://secunia.com/advisories/17319 Not Applicable
http://secunia.com/advisories/17487 Not Applicable
http://secunia.com/advisories/17813 Not Applicable
http://secunia.com/advisories/19072 Not Applicable
http://secunia.com/advisories/19073 Not Applicable
http://secunia.com/advisories/19185 Not Applicable
http://secunia.com/advisories/19317 Not Applicable
http://secunia.com/advisories/23074 Not Applicable
http://securitytracker.com/id?1014323 Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm Third Party Advisory
http://www.securityfocus.com/bid/14106 Broken Link
http://www.securityfocus.com/bid/15647 Broken Link
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11452 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1237 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1526 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1629 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840 Broken Link
https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.html Broken Link
URL Date SRC
http://securityreason.com/securityalert/604 2024-08-07
http://www.securiteam.com/securityreviews/5GP0220G0U.html 2024-08-07
URL Date SRC
URL Date SRC
http://docs.info.apple.com/article.html?artnum=302847 2024-02-09
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html 2024-02-09
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000 2024-02-09
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1 2024-02-09
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 2024-02-09
http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only 2024-02-09
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only 2024-02-09
http://www.apache.org/dist/httpd/CHANGES_1.3 2024-02-09
http://www.apache.org/dist/httpd/CHANGES_2.0 2024-02-09
http://www.debian.org/security/2005/dsa-803 2024-02-09
http://www.debian.org/security/2005/dsa-805 2024-02-09
http://www.mandriva.com/security/advisories?name=MDKSA-2005:130 2024-02-09
http://www.novell.com/linux/security/advisories/2005_18_sr.html 2024-02-09
http://www.novell.com/linux/security/advisories/2005_46_apache.html 2024-02-09
http://www.redhat.com/support/errata/RHSA-2005-582.html 2024-02-09
http://www.securityfocus.com/archive/1/428138/100/0/threaded 2024-02-09
http://www.ubuntu.com/usn/usn-160-2 2024-02-09
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828 2024-02-09
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E 2024-02-09
https://access.redhat.com/security/cve/CVE-2005-2088 2005-07-25
https://bugzilla.redhat.com/show_bug.cgi?id=1617682 2005-07-25
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 >= 2.0.35 < 2.0.55
Search vendor "Apache" for product "Http Server" and version " >= 2.0.35 < 2.0.55"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 3.0
Search vendor "Debian" for product "Debian Linux" and version "3.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 3.1
Search vendor "Debian" for product "Debian Linux" and version "3.1"
-
Affected