Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2006-3918

Published: 28/07/2006 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 435
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Apache

Vulnerability Summary

http_protocol.c in (1) IBM HTTP Server 6.0 prior to 6.0.2.13 and 6.1 prior to 6.1.0.1, and (2) Apache HTTP Server 1.3 prior to 1.3.35, 2.0 prior to 2.0.58, and 2.2 prior to 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

debian debian linux 3.1

canonical ubuntu linux 7.04

canonical ubuntu linux 7.10

canonical ubuntu linux 6.10

canonical ubuntu linux 6.06

redhat enterprise linux server 2.0

redhat enterprise linux workstation 2.0

Vendor Advisories

Ubuntu Security Notice: apache2 vulnerabilities
It was discovered that Apache did not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a craf ...
Debian Security Advisories: DSA-1167-1 apache -- missing input sanitising
Several remote vulnerabilities have been discovered in the Apache, the worlds most popular webserver, which may lead to the execution of arbitrary web script The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-3352 A cross-site scripting (XSS) flaw exists in the mod_imap component of the Apache serve ...
Debian CVElist Bug Report Logs: CVE-2006-3747: off-by-one security problem in mod_rewrite
Debian Bug report logs - #380182 CVE-2006-3747: off-by-one security problem in mod_rewrite Package: apache2; Maintainer for apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache2 is src:apache2 (PTS, buildd, popcon) Reported by: sf@sfritschde Date: Fri, 28 Jul 2006 08:48:01 UTC Severity ...
Debian CVElist Bug Report Logs: CVE-2006-3918: Missing Expect header sanitation may lead to XSS vulnerabilities
Debian Bug report logs - #381376 CVE-2006-3918: Missing Expect header sanitation may lead to XSS vulnerabilities Package: apache2; Maintainer for apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache2 is src:apache2 (PTS, buildd, popcon) Reported by: Stefan Fritsch <sf@sfritschde> ...

Exploits

Exploit DB: Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security
source: wwwsecurityfocuscom/bid/19661/info Apache HTTP server is prone to a security weakness related to HTTP request headers An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks var req:LoadVars=new LoadVars(); reqaddRequestHeader("Expect", "<script>alert('gotcha!')</s ...
Exploit DB: Oracle HTTP Server Header Cross Site Scripting
Oracle HTTP Server for Oracle Application Server 10g version 101202 suffers from a cross site scripting vulnerability ...
Exploit DB: ProCheckUp Security Advisory 2007.37
A cross site scripting vulnerability has been discovered in Apache versions 22x and 20x using a malformed HTTP request with 413 error pages ...

References

CWE-79http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.htmlhttp://archives.neohapsis.com/archives/bugtraq/2006-07/0425.htmlhttp://svn.apache.org/viewvc?view=rev&revision=394965http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631http://secunia.com/advisories/21172http://secunia.com/advisories/21174http://securitytracker.com/id?1016569http://www-1.ibm.com/support/docview.wss?uid=swg24013080http://rhn.redhat.com/errata/RHSA-2006-0618.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0619.htmlhttp://secunia.com/advisories/21399http://secunia.com/advisories/21478http://www.debian.org/security/2006/dsa-1167ftp://patches.sgi.com/support/free/security/advisories/20060801-01-Phttp://secunia.com/advisories/21848http://secunia.com/advisories/21598http://secunia.com/advisories/21744http://www.novell.com/linux/security/advisories/2006_51_apache.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2006-194.htmhttp://secunia.com/advisories/21986http://rhn.redhat.com/errata/RHSA-2006-0692.htmlhttp://secunia.com/advisories/22140http://openbsd.org/errata.html#httpd2http://www.securityfocus.com/bid/19661http://secunia.com/advisories/22317http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117http://secunia.com/advisories/22523http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.htmlhttp://securityreason.com/securityalert/1294http://www.ubuntu.com/usn/usn-575-1http://secunia.com/advisories/28749http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://secunia.com/advisories/29640http://marc.info/?l=bugtraq&m=125631037611762&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://www.vupen.com/english/advisories/2006/2964http://www.vupen.com/english/advisories/2006/5089http://www.vupen.com/english/advisories/2006/3264http://www.vupen.com/english/advisories/2006/2963http://www.vupen.com/english/advisories/2006/4207http://marc.info/?l=bugtraq&m=130497311408250&w=2http://www.vupen.com/english/advisories/2010/1572http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.htmlhttp://www.securitytracker.com/id?1024144http://secunia.com/advisories/40256https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3Ehttps://usn.ubuntu.com/575-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/28424/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook