Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

Bugtraq ID:	26663
Class:	Input Validation Error
CVE:	CVE-2007-6203
Remote:	Yes
Local:	No
Published:	Nov 30 2007 12:00AM
Updated:	Feb 11 2014 12:26AM
Credit:	Adrian Pastor and Amir Azam of ProCheckUp Ltd. is credited with the discovery of this vulnerability.
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Server 11 x64 Turbolinux Turbolinux Server 11 Turbolinux Turbolinux Server 10.0.0 x64 TurboLinux Personal TurboLinux Multimedia Turbolinux FUJI 0 Turbolinux Appliance Server 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop SDK 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc IBM HTTP Server 6.1 .15 IBM HTTP Server 6.0.2 .27 IBM HTTP Server 6.0.2 .13 IBM HTTP Server 2.0.47 .1 IBM HTTP Server 2.0.47 IBM HTTP Server 6.1.0.13 IBM HTTP Server 6.1.0.1 IBM HTTP Server 6.1.0 IBM HTTP Server 6.0.2.23 IBM HTTP Server 6.0.2.19 IBM HTTP Server 6.0.2.12 IBM Hardware Management Console (HMC) for pSeries 6.0 R1.3 IBM Hardware Management Console (HMC) for iSeries 6.0 R1.3 HP HP-UX B.11.31 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.11 Gentoo Linux Fujitsu INTERSTAGE Studio Enterprise Edition 9.0 Fujitsu INTERSTAGE Studio Enterprise Edition 8.0.1 Fujitsu INTERSTAGE Job Workload Server 8.1 Fujitsu INTERSTAGE Apworks Modelers-J Edition 7.0 Fujitsu INTERSTAGE Apworks Modelers-J Edition 6.0A Fujitsu INTERSTAGE Apworks Modelers-J Edition 6.0 Fujitsu iNTERSTAGE Application Server Web-J Edition 5.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0.2 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0 Fujitsu iNTERSTAGE Application Server Standard Edition 5.0 Fujitsu INTERSTAGE Application Server Plus Developer 5.0.1 Fujitsu INTERSTAGE Application Server Plus Developer 7.0 Fujitsu INTERSTAGE Application Server Plus Developer 6.0 Fujitsu Interstage Application Server Plus 7.0.1 Fujitsu Interstage Application Server Plus 5.0.1 Fujitsu Interstage Application Server Plus 7.0 Fujitsu Interstage Application Server Plus 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0 A Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apache Software Foundation Apache 2.2.4 Apache Software Foundation Apache 2.2.3 Apache Software Foundation Apache 2.2.2 Apache Software Foundation Apache 2.2 Apache Software Foundation Apache 2.1.8 Apache Software Foundation Apache 2.1.7 Apache Software Foundation Apache 2.1.6 Apache Software Foundation Apache 2.1.5 Apache Software Foundation Apache 2.1.4 Apache Software Foundation Apache 2.1.3 Apache Software Foundation Apache 2.1.2 Apache Software Foundation Apache 2.1.1 Apache Software Foundation Apache 2.1 Apache Software Foundation Apache 2.0.59 Apache Software Foundation Apache 2.0.58 Apache Software Foundation Apache 2.0.55 Apache Software Foundation Apache 2.0.54 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Apache Software Foundation Apache 2.0.53 Apache Software Foundation Apache 2.0.52 Apache Software Foundation Apache 2.0.51 Apache Software Foundation Apache 2.0.50 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 Apache Software Foundation Apache 2.0.49 + S.u.S.E. Linux Personal 9.1 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Software Foundation Apache 2.0.48 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux 8.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Software Foundation Apache 2.0.47 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.1.5 + Apple Mac OS X Server 10.1.4 + Apple Mac OS X Server 10.1.3 + Apple Mac OS X Server 10.1.2 + Apple Mac OS X Server 10.1.1 + Apple Mac OS X Server 10.1 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 Apache Software Foundation Apache 2.0.46 + Red Hat Enterprise Linux AS 3 + RedHat Desktop 3.0 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux WS 3 + Trustix Secure Linux 2.0
Not Vulnerable:	Apache Software Foundation Apache 2.2.8

Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

Apache is prone to a cross-site scripting weakness when handling HTTP request methods that result in 413 HTTP errors.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

Apache 2.0.46 through 2.2.4 are vulnerable; other versions may also be affected.

Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

Attackers can potentially exploit this issue via browser plugins such as Flash.

An example HTTP request to demonstrate this issue is available:

<BADCHARS> / HTTP/1.1
Host: example.com
Connection: close
Content-length: -1
[LF]
[LF]

The following proof of concept demonstrates the issue:

• /data/vulnerabilities/exploits/26663.txt

Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

Solution:
This issue has been fixed in Apache 2.2.8. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_powerpc.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_powerpc.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_powerpc.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_powerpc.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_powerpc.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_sparc.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_sparc.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_sparc.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_sparc.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_sparc.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_sparc.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_sparc.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_powerpc.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_powerpc.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_lpia.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_lpia.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_lpia.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_lpia.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_lpia.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_i386.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_i386.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_i386.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.4-3u buntu0.2_lpia.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.4- 3ubuntu0.2_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.4-3 ubuntu0.2_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.4- 3ubuntu0.2_lpia.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.4 -3ubuntu0.2_lpia.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.4-3ubunt u0.2_lpia.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.4-3ub untu0.2_lpia.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Apple Mac OS X 10.5.2

• Apple SecUpd2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002.dmg

Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

References:

• Apache Homepage (Apache Software Foundation)
  
• ASF Bugzilla Bug 44014 (Apache Software Foundation)
  
• httpd 2.2.8 Changelog (Apache Software Foundation)
  
• PK65782; 2.0.47.1: IBM HTTP Server V2.0.47 Cumulative Interim Fix (IBM)
  
• PTF MH01110 - Security fixes for HMC V6R1.3 (IBM)
  
• PR07-37: XSS on Apache HTTP Server 413 error pages via malformed HTTP method ([email protected])
  
• Interstage HTTP Server: Cross-site Scripting Problem (CVE-2007-4465/ CVE-2007-62 (Fujitsu)
  
• PK57952: INPUT METHOD NOT ESCAPED IN DEFAULT 413 ERROR RESPONSE (IBM)