CVE-2006-3918

Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

http_protocol.c en (1) IBM HTTP Server 6.0 anterioa a 6.0.2.13 y 6.1 anterior 6.1.0.1, y (2) Apache HTTP Server 1.3 anterior a 1.3.35, 2.0 anterior a 2.0.58, y 2.2 anterior a 2.2.2, no desinfecta la cabecera Expect desde una respuesta HTTP cuando se refleja en un mensaje de error, lo cul podría permitir un ataque de tipo secuencia de comandos en sitios cruzados (XSS) utilizando los componentes web del cliente que puede enviar cabeceras de su elección en las respuesta, como se demostró con la utilización de un archivo Flash SWF.

Several remote vulnerabilities have been discovered in the Apache, the worlds most popular webserver, which may lead to the execution of arbitrary web scripts. A cross-site scripting (XSS) flaw exists in the mod_imap component of the Apache server. Apache does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-07-27 CVE Reserved
2006-07-28 CVE Published
2011-06-14 First Exploit
2024-08-07 CVE Updated
2025-07-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (54)

URL	Tag	Source
http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html	Third Party Advisory
http://secunia.com/advisories/21399	Not Applicable
http://secunia.com/advisories/21478	Not Applicable
http://secunia.com/advisories/21598	Not Applicable
http://secunia.com/advisories/21744	Not Applicable
http://secunia.com/advisories/21848	Not Applicable
http://secunia.com/advisories/21986	Not Applicable
http://secunia.com/advisories/22140	Not Applicable
http://secunia.com/advisories/22317	Not Applicable
http://secunia.com/advisories/22523	Not Applicable
http://secunia.com/advisories/28749	Not Applicable
http://secunia.com/advisories/29640	Not Applicable
http://secunia.com/advisories/40256	Not Applicable
http://securitytracker.com/id?1016569	Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm	Third Party Advisory
http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html	Third Party Advisory
http://www.securityfocus.com/bid/19661	Third Party Advisory
http://www.securitytracker.com/id?1024144	Broken Link
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117	Broken Link
https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238	Signature

URL	Date	SRC
https://packetstorm.news/files/id/102234	2011-06-14
https://www.exploit-db.com/exploits/28424	2013-09-21
http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html	2024-08-07
http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html	2024-08-07
http://securityreason.com/securityalert/1294	2024-08-07
http://svn.apache.org/viewvc?view=rev&revision=394965	2024-08-07

URL	Date	SRC
http://secunia.com/advisories/21172	2023-11-07
http://secunia.com/advisories/21174	2023-11-07

URL	Date	SRC
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html	2023-11-07
http://marc.info/?l=bugtraq&m=125631037611762&w=2	2023-11-07
http://marc.info/?l=bugtraq&m=129190899612998&w=2	2023-11-07
http://marc.info/?l=bugtraq&m=130497311408250&w=2	2023-11-07
http://openbsd.org/errata.html#httpd2	2023-11-07
http://rhn.redhat.com/errata/RHSA-2006-0618.html	2023-11-07
http://rhn.redhat.com/errata/RHSA-2006-0692.html	2023-11-07
http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631	2023-11-07
http://www-1.ibm.com/support/docview.wss?uid=swg24013080	2023-11-07
http://www.debian.org/security/2006/dsa-1167	2023-11-07
http://www.novell.com/linux/security/advisories/2006_51_apache.html	2023-11-07
http://www.redhat.com/support/errata/RHSA-2006-0619.html	2023-11-07
http://www.ubuntu.com/usn/usn-575-1	2023-11-07
https://access.redhat.com/security/cve/CVE-2006-3918	2010-08-04
https://bugzilla.redhat.com/show_bug.cgi?id=200732	2010-08-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Http Server Search vendor "Apache" for product "Http Server"				>= 1.3.3 < 1.3.35 Search vendor "Apache" for product "Http Server" and version " >= 1.3.3 < 1.3.35"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				3.1 Search vendor "Debian" for product "Debian Linux" and version "3.1"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				7.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				7.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				2.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "2.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				2.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "2.0"		-		Affected