NX5Linkx Links.PHP HTTP Response Splitting Vulnerability

Bugtraq ID:	20011
Class:	Input Validation Error
CVE:	CVE-2006-4505
Remote:	Yes
Local:	No
Published:	Sep 13 2006 12:00AM
Updated:	Sep 14 2006 07:52PM
Credit:	Aliaksandr Hartsuyeu is credited with the discovery of this vulnerability.
Vulnerable:	NX5 NX5Linkx 1.0
Not Vulnerable:

NX5Linkx Links.PHP HTTP Response Splitting Vulnerability

NX5Linkx is prone to an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

NX5Linkx Links.PHP HTTP Response Splitting Vulnerability

An exploit is not required.

An example URI has been provided:

http://www.example.com% 0D%0A%0D%0AHTTP/1.0 200 OK%0D%0A%0D% 0A.......

NX5Linkx Links.PHP HTTP Response Splitting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

NX5Linkx Links.PHP HTTP Response Splitting Vulnerability

References:

• NX5 Homepage (NX5)
  
• [eVuln] NX5Linkx Multiple Vulnerabilities (Alex)