Vulnerability Name:

CVE-2006-3918 (CCN-28620)

Assigned:2006-05-08
Published:2006-05-08
Updated:2021-06-06
Summary:http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
CVSS v3 Severity:4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.4 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
CWE-79
Vulnerability Consequences:Gain Access
References:Source: SGI
Type: UNKNOWN
20060801-01-P

Source: BUGTRAQ
Type: Exploit
20060508 Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1

Source: CCN
Type: BugTraq Mailing List, Mon May 08 2006 - 14:01:27 CDT
Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1

Source: BUGTRAQ
Type: Exploit
20060724 Write-up by Amit Klein: "Forging HTTP request headers with Flash"

Source: CCN
Type: BugTraq Mailing List, Mon Jul 24 2006 - 14:28:59 CDT
Write-up by Amit Klein: "Forging HTTP request headers with Flash"

Source: MITRE
Type: CNA
CVE-2006-3918

Source: CCN
Type: VMware Security Response
Security Response to CVE-2006-3918

Source: CONFIRM
Type: UNKNOWN
http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html

Source: SUSE
Type: UNKNOWN
SUSE-SA:2008:021

Source: HP
Type: UNKNOWN
HPSBUX02465

Source: HP
Type: UNKNOWN
HPSBUX02612

Source: HP
Type: UNKNOWN
SSRT090208

Source: OPENBSD
Type: UNKNOWN
[3.9] 012: SECURITY FIX: October 7, 2006

Source: CCN
Type: RHSA-2006-0618
apache security update

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0618

Source: CCN
Type: RHSA-2006-0619
httpd security update

Source: CCN
Type: RHSA-2006-0692
apache security update for Stronghold

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0692

Source: CCN
Type: RHSA-2008-0523
Low: Red Hat Network Proxy Server security update

Source: CCN
Type: RHSA-2010-0602
Moderate: Red Hat Certificate System 7.3 security update

Source: CCN
Type: SA21172
Apache "Expect" Header Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
21172

Source: CCN
Type: SA21174
IBM HTTP Server "Expect" Header Cross-Site Scripting

Source: SECUNIA
Type: Patch, Vendor Advisory
21174

Source: SECUNIA
Type: UNKNOWN
21399

Source: CCN
Type: SA21478
IBM HTTP Server Two Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
21478

Source: SECUNIA
Type: UNKNOWN
21598

Source: SECUNIA
Type: UNKNOWN
21744

Source: SECUNIA
Type: UNKNOWN
21848

Source: CCN
Type: SA21986
Avaya Products Apache "Expect" Header Cross-Site Scripting

Source: SECUNIA
Type: UNKNOWN
21986

Source: SECUNIA
Type: UNKNOWN
22140

Source: SECUNIA
Type: UNKNOWN
22317

Source: CCN
Type: SA22523
IBM HMC Apache2 / OpenSSL Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
22523

Source: SECUNIA
Type: UNKNOWN
28749

Source: SECUNIA
Type: UNKNOWN
29640

Source: CCN
Type: SA40256
F-Secure Policy Manager Expect Header Cross-Site Scripting

Source: SECUNIA
Type: UNKNOWN
40256

Source: SREASON
Type: UNKNOWN
1294

Source: CCN
Type: SECTRACK ID: 1016569
IBM HTTP Server (IHS) Lack of Input Validation in Expect Header May Permit Cross-Site Scripting Attacks

Source: SECTRACK
Type: UNKNOWN
1016569

Source: CCN
Type: SECTRACK ID: 1024144
F-Secure Policy Manager Input Validation Bug Permits Cross-Site Scripting Attacks Via the Expect Header

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm

Source: CCN
Type: ASA-2006-194
httpd security update (RHSA-2006-0619)

Source: CCN
Type: ASA-2006-212
apache security update (RHSA-2006-0618)

Source: CCN
Type: Apache-SVN
Revision 394965

Source: CONFIRM
Type: Exploit
http://svn.apache.org/viewvc?view=rev&revision=394965

Source: AIXAPAR
Type: UNKNOWN
PK24631

Source: CCN
Type: IBM Support & downloads
PK24631: HTTP EXPECT HEADER VALUE CAN BE ECHOED TO BROWSER UNESCAPED

Source: AIXAPAR
Type: UNKNOWN
PK27875

Source: DEBIAN
Type: UNKNOWN
DSA-1167

Source: DEBIAN
Type: DSA-1167
apache -- missing input sanitising

Source: CCN
Type: FSC-2010-2
Expect-header sanitation vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:051

Source: CCN
Type: OSVDB ID: 65680
F-Secure Policy Manager Expect: Header XSS

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0619

Source: BID
Type: UNKNOWN
19661

Source: CCN
Type: BID-19661
Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness

Source: SECTRACK
Type: UNKNOWN
1024144

Source: CCN
Type: TLSA-2006-24
Cross-site scripting vulnerability

Source: CCN
Type: USN-575-1
Apache vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-575-1

Source: VUPEN
Type: UNKNOWN
ADV-2006-2963

Source: VUPEN
Type: UNKNOWN
ADV-2006-2964

Source: VUPEN
Type: UNKNOWN
ADV-2006-3264

Source: VUPEN
Type: UNKNOWN
ADV-2006-4207

Source: VUPEN
Type: UNKNOWN
ADV-2006-5089

Source: VUPEN
Type: UNKNOWN
ADV-2010-1572

Source: CONFIRM
Type: UNKNOWN
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117

Source: XF
Type: UNKNOWN
httpserver-expect-header-xss(28620)

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10352

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12238

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [06-13-2011]

Source: SUSE
Type: SUSE-SA:2006:051
Apache2 SSLVerifyClient problems

Source: SUSE
Type: SUSE-SA:2008:021
Apache security problems

Source: CCN
Type: IBM Systems Support Web site
Support for HMC

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:http_server:1.3.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.19:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:http_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:http_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.12:*:win32:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.11:*:win32:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.0.57:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.22:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:http_server:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.0.57:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:http_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:http_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:certificate_system:7.3:*:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:stronghold:-:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:personal:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:multimedia:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:2.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:network_proxy:4.2:*:*:*:*:*:*:*
  • OR cpe:/o:vmware:esx:2.0:build_5257:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:3.0.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20063918
    V
    		CVE-2006-3918
    2015-11-16
    oval:org.mitre.oval:def:12238
    V
    		HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Remote Denial of Service (DoS)
    2015-04-20
    oval:org.mitre.oval:def:17648
    P
    		USN-575-1 -- apache2 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:10352
    V
    		http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
    2013-04-29
    oval:org.debian:def:1167
    V
    		missing input sanitising
    2006-09-04
    oval:com.redhat.rhsa:def:20060619
    P
    		RHSA-2006:0619: httpd security update (Moderate)
    2006-08-10
    BACK
    apache http server 1.3.18
    apache http server 1.3.19
    ibm http server 6.0
    ibm http server 6.1
    apache http server 1.3.12
    apache http server 1.3.17
    apache http server 2.2
    apache http server 2.2.1
    apache http server 1.3.11
    apache http server 1.3.12
    apache http server 2.0
    apache http server 2.0.57
    apache http server 1.3.1
    apache http server 1.3.20
    apache http server 1.3
    apache http server 1.3.22
    apache http server 1.3
    apache http server 1.3.1
    apache http server 1.3.19
    apache http server 2.0
    apache http server 1.3.12
    apache http server 1.3.20
    apache http server 1.3.17
    apache http server 1.3.11
    apache http server 1.3.22
    apache http server 1.3.18
    apache http server 2.0.57
    apache http server 2.2
    apache http server 2.2.1
    ibm http server 6.0
    ibm http server 6.1
    redhat certificate system 7.3
    redhat stronghold -
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    suse suse linux 9.0
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux 9.2
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    novell open enterprise server *
    suse suse linux 10.0
    redhat linux advanced workstation 2.1
    canonical ubuntu 6.06
    novell suse linux enterprise server 10 sp2
    turbolinux turbolinux fuji
    turbolinux turbolinux personal *
    turbolinux turbolinux home *
    turbolinux turbolinux multimedia *
    canonical ubuntu 7.04
    canonical ubuntu 7.10
    vmware esx server 2.5.5
    novell open enterprise server *
    redhat network proxy 4.2
    vmware esx server 2.0_build_5257
    novell opensuse 10.2
    novell opensuse 10.3
    suse suse linux 9.3
    vmware esx server 3.0.3