// For flags

CVE-2006-3918

Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security

Severity Score

4.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

http_protocol.c en (1) IBM HTTP Server 6.0 anterioa a 6.0.2.13 y 6.1 anterior 6.1.0.1, y (2) Apache HTTP Server 1.3 anterior a 1.3.35, 2.0 anterior a 2.0.58, y 2.2 anterior a 2.2.2, no desinfecta la cabecera Expect desde una respuesta HTTP cuando se refleja en un mensaje de error, lo cul podría permitir un ataque de tipo secuencia de comandos en sitios cruzados (XSS) utilizando los componentes web del cliente que puede enviar cabeceras de su elección en las respuesta, como se demostró con la utilización de un archivo Flash SWF.

Oracle HTTP Server for Oracle Application Server 10g version 10.1.2.0.2 suffers from a cross site scripting vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-07-27 CVE Reserved
  • 2006-07-28 CVE Published
  • 2006-08-24 First Exploit
  • 2024-02-06 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (53)
URL Tag Source
http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html Third Party Advisory
http://secunia.com/advisories/21399 Not Applicable
http://secunia.com/advisories/21478 Not Applicable
http://secunia.com/advisories/21598 Not Applicable
http://secunia.com/advisories/21744 Not Applicable
http://secunia.com/advisories/21848 Not Applicable
http://secunia.com/advisories/21986 Not Applicable
http://secunia.com/advisories/22140 Not Applicable
http://secunia.com/advisories/22317 Not Applicable
http://secunia.com/advisories/22523 Not Applicable
http://secunia.com/advisories/28749 Not Applicable
http://secunia.com/advisories/29640 Not Applicable
http://secunia.com/advisories/40256 Not Applicable
http://securitytracker.com/id?1016569 Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm Third Party Advisory
http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html Third Party Advisory
http://www.securityfocus.com/bid/19661 Third Party Advisory
http://www.securitytracker.com/id?1024144 Broken Link
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 Broken Link
https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238 Signature
URL Date SRC
https://www.exploit-db.com/exploits/28424 2006-08-24
http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html 2024-08-07
http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html 2024-08-07
http://securityreason.com/securityalert/1294 2024-08-07
http://svn.apache.org/viewvc?view=rev&revision=394965 2024-08-07
URL Date SRC
http://secunia.com/advisories/21172 2023-11-07
http://secunia.com/advisories/21174 2023-11-07
URL Date SRC
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html 2023-11-07
http://marc.info/?l=bugtraq&m=125631037611762&w=2 2023-11-07
http://marc.info/?l=bugtraq&m=129190899612998&w=2 2023-11-07
http://marc.info/?l=bugtraq&m=130497311408250&w=2 2023-11-07
http://openbsd.org/errata.html#httpd2 2023-11-07
http://rhn.redhat.com/errata/RHSA-2006-0618.html 2023-11-07
http://rhn.redhat.com/errata/RHSA-2006-0692.html 2023-11-07
http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631 2023-11-07
http://www-1.ibm.com/support/docview.wss?uid=swg24013080 2023-11-07
http://www.debian.org/security/2006/dsa-1167 2023-11-07
http://www.novell.com/linux/security/advisories/2006_51_apache.html 2023-11-07
http://www.redhat.com/support/errata/RHSA-2006-0619.html 2023-11-07
http://www.ubuntu.com/usn/usn-575-1 2023-11-07
https://access.redhat.com/security/cve/CVE-2006-3918 2010-08-04
https://bugzilla.redhat.com/show_bug.cgi?id=200732 2010-08-04
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 >= 1.3.3 < 1.3.35
Search vendor "Apache" for product "Http Server" and version " >= 1.3.3 < 1.3.35"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 3.1
Search vendor "Debian" for product "Debian Linux" and version "3.1"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Server
Search vendor "Redhat" for product "Enterprise Linux Server"
 2.0
Search vendor "Redhat" for product "Enterprise Linux Server" and version "2.0"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Workstation
Search vendor "Redhat" for product "Enterprise Linux Workstation"
 2.0
Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "2.0"
-
Affected