BID:38960

Interchange HTTP Response Splitting Vulnerability

Info

Interchange HTTP Response Splitting Vulnerability

Bugtraq ID:	38960
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 23 2010 12:00AM
Updated:	Mar 23 2010 12:00AM
Credit:	The vendor
Vulnerable:	Interchange Interchange 5.6.2 Interchange Interchange 5.6.1 Interchange Interchange 5.4.4 Interchange Interchange 5.4.3 Interchange Interchange 5.4.2 Interchange Interchange 5.4.1 Interchange Interchange 5.6

Not Vulnerable:	Interchange Interchange 5.6.3 Interchange Interchange 5.4.5

Discussion

Interchange HTTP Response Splitting Vulnerability

Interchange is prone to an HTTP response-splitting vulnerability.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Interchange versions prior to 5.6.3 and 5.4.5 are vulnerable.

Exploit / POC

Interchange HTTP Response Splitting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

Solution / Fix

Interchange HTTP Response Splitting Vulnerability

Solution:
This issue has been addressed in Interchange 5.4.5 and 5.6.3.

Interchange Interchange 5.6