OpenNMS HTTP Response Splitting Vulnerability
BID:31577
Info
OpenNMS HTTP Response Splitting Vulnerability
| Bugtraq ID: | 31577 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 05 2008 12:00AM |
| Updated: | Oct 07 2008 03:38PM |
| Credit: | BugSec LTD |
| Vulnerable: |
OpenNMS OpenNMS 1.5.93 OpenNMS OpenNMS 1.5.92 OpenNMS OpenNMS 1.5.91 |
| Not Vulnerable: |
OpenNMS OpenNMS 1.5.96 OpenNMS OpenNMS 1.5.95 OpenNMS OpenNMS 1.5.94 |
Discussion
OpenNMS HTTP Response Splitting Vulnerability
OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Versions prior to OpenNMS 1.5.94 are vulnerable.
OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Versions prior to OpenNMS 1.5.94 are vulnerable.
Exploit / POC
OpenNMS HTTP Response Splitting Vulnerability
Attackers can leverage the issue to corrupt a cached version of a page or entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
http://www.example.com/opennms/event/query?%0D%0AContent-Length:%200%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text
/html%0D%0AContent-Length:%2036%0D%0A%0D%0A<html><body>BugSec</body></html><!--
Attackers can leverage the issue to corrupt a cached version of a page or entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
http://www.example.com/opennms/event/query?%0D%0AContent-Length:%200%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text
/html%0D%0AContent-Length:%2036%0D%0A%0D%0A<html><body>BugSec</body></html><!--
Solution / Fix
OpenNMS HTTP Response Splitting Vulnerability
Solution:
Reports indicate that this issue has been fixed since OpenNMS 1.5.94, but Symantec could not verify this information.
Solution:
Reports indicate that this issue has been fixed since OpenNMS 1.5.94, but Symantec could not verify this information.
References
OpenNMS HTTP Response Splitting Vulnerability
References:
References:
- Home Page (OpenNMS)
- OpenNMS Multiple Vulnerabilities (Trancer