National Cyber Awareness System

Vulnerability Summary for CVE-2008-0005

Overview

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.2.8 and 2.0.63: http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-1695

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html

External Source: FEDORA

Name: FEDORA-2008-1711

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html

External Source: XF

Name: apache-modproxyftp-utf7-xss(39615)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39615

External Source: VUPEN

Name: ADV-2008-1875

Hyperlink:http://www.vupen.com/english/advisories/2008/1875/references

External Source: VUPEN

Name: ADV-2008-0924

Hyperlink:http://www.vupen.com/english/advisories/2008/0924/references

External Source: UBUNTU

Name: USN-575-1

Hyperlink:http://www.ubuntu.com/usn/usn-575-1

External Source: SECTRACK

Name: 1019185

Hyperlink:http://www.securitytracker.com/id?1019185

External Source: BID

Name: 27234

Hyperlink:http://www.securityfocus.com/bid/27234

External Source: BUGTRAQ

Name: 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/505990/100/0/threaded

External Source: BUGTRAQ

Name: 20080110 SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486167/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0009

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0009.html

External Source: REDHAT

Name: RHSA-2008:0008

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0008.html

External Source: REDHAT

Name: RHSA-2008:0007

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0007.html

External Source: REDHAT

Name: RHSA-2008:0006

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0006.html

External Source: REDHAT

Name: RHSA-2008:0005

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0005.html

External Source: REDHAT

Name: RHSA-2008:0004

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0004.html

External Source: MANDRIVA

Name: MDVSA-2008:016

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:016

External Source: MANDRIVA

Name: MDVSA-2008:015

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:015

External Source: MANDRIVA

Name: MDVSA-2008:014

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:014

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm

External Source: SREASON

Name: 3526

Hyperlink:http://securityreason.com/securityalert/3526

External Source: SREASONRES

Name: 20080110 Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability

Hyperlink:http://securityreason.com/achievement_securityalert/49

External Source: GENTOO

Name: GLSA-200803-19

Hyperlink:http://security.gentoo.org/glsa/glsa-200803-19.xml

External Source: SECUNIA

Name: 35650

Hyperlink:http://secunia.com/advisories/35650

External Source: SECUNIA

Name: 30732

Hyperlink:http://secunia.com/advisories/30732

External Source: SECUNIA

Name: 29640

Hyperlink:http://secunia.com/advisories/29640

External Source: SECUNIA

Name: 29420

Hyperlink:http://secunia.com/advisories/29420

External Source: SECUNIA

Name: 29348

Hyperlink:http://secunia.com/advisories/29348

External Source: SECUNIA

Name: 28977

Hyperlink:http://secunia.com/advisories/28977

External Source: SECUNIA

Name: 28749

Hyperlink:http://secunia.com/advisories/28749

External Source: SECUNIA

Name: 28607

Hyperlink:http://secunia.com/advisories/28607

External Source: SECUNIA

Name: 28526

Hyperlink:http://secunia.com/advisories/28526

External Source: SECUNIA

Name: 28471

Hyperlink:http://secunia.com/advisories/28471

External Source: SECUNIA

Name: 28467

Hyperlink:http://secunia.com/advisories/28467

External Source: OVAL

Name: oval:org.mitre.oval:def:10812

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10812

External Source: HP

Name: SSRT090208

Hyperlink:http://marc.info/?l=bugtraq&m=130497311408250&w=2

External Source: HP

Name: HPSBOV02683

Hyperlink:http://marc.info/?l=bugtraq&m=130497311408250&w=2

External Source: HP

Name: HPSBUX02465

Hyperlink:http://marc.info/?l=bugtraq&m=125631037611762&w=2

External Source: HP

Name: HPSBUX02465

Hyperlink:http://marc.info/?l=bugtraq&m=125631037611762&w=2

External Source: HP

Name: HPSBUX02431

Hyperlink:http://marc.info/?l=bugtraq&m=124654546101607&w=2

External Source: HP

Name: HPSBUX02431

Hyperlink:http://marc.info/?l=bugtraq&m=124654546101607&w=2

External Source: MLIST

Name: [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server

Hyperlink:http://lists.vmware.com/pipermail/security-announce/2009/000062.html

External Source: SUSE

Name: SUSE-SA:2008:021

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

External Source: APPLE

Name: APPLE-SA-2008-03-18

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307562

Hyperlink:http://docs.info.apple.com/article.html?artnum=307562

References to Check Content

Identifier:oval:org.mitre.oval:def:10812

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10812