Multiple Vendor HTTP Response Splitting Vulnerability
BID:9804
Info
Multiple Vendor HTTP Response Splitting Vulnerability
| Bugtraq ID: | 9804 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 04 2004 12:00AM |
| Updated: | Mar 04 2004 12:00AM |
| Credit: | Amit Klein of Sanctum Inc. is credited with discovering how various implementations may contribute to CR/LF attacks. |
| Vulnerable: |
Sun Java System Web Server 6.1 Squid Web Proxy Cache 2.5 .STABLE7 Squid Web Proxy Cache 2.5 .STABLE6 Squid Web Proxy Cache 2.5 .STABLE5 Squid Web Proxy Cache 2.5 .STABLE4 Squid Web Proxy Cache 2.5 .STABLE3 Squid Web Proxy Cache 2.5 .STABLE1 Squid Web Proxy Cache 2.4 .STABLE7 Squid Web Proxy Cache 2.4 .STABLE6 Squid Web Proxy Cache 2.4 .STABLE2 Squid Web Proxy Cache 2.4 Squid Web Proxy Cache 2.3 .STABLE5 Squid Web Proxy Cache 2.3 .STABLE4 NetApp NetCache 5.2 National Science Foundation Squid Web Proxy 2.4 STABLE7 National Science Foundation Squid Web Proxy 2.4 STABLE6 National Science Foundation Squid Web Proxy 2.4 STABLE4 National Science Foundation Squid Web Proxy 2.4 STABLE3 National Science Foundation Squid Web Proxy 2.4 STABLE2-3 National Science Foundation Squid Web Proxy 2.4 STABLE2-2 National Science Foundation Squid Web Proxy 2.4 STABLE2 National Science Foundation Squid Web Proxy 2.4 STABLE1 National Science Foundation Squid Web Proxy 2.4 PRE-STABLE2 National Science Foundation Squid Web Proxy 2.4 PRE-STABLE National Science Foundation Squid Web Proxy 2.4 DEVEL4 National Science Foundation Squid Web Proxy 2.4 DEVEL2 National Science Foundation Squid Web Proxy 2.4 Microsoft ISA Server 2000 SP1 Microsoft ISA Server 2000 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft ASP.NET 1.1 Microsoft ASP.NET 1.0 Microsoft ASP 3.0 Macromedia ColdFusion Server MX 6.1 Macromedia ColdFusion Server MX 6.0 IBM Websphere Application Server 5.1.1 IBM Websphere Application Server 5.1 .0.5 IBM Websphere Application Server 5.1 .0.4 IBM Websphere Application Server 5.1 .0.3 IBM Websphere Application Server 5.1 .0.2 IBM Websphere Application Server 5.0.2 .6 IBM Websphere Application Server 5.0.2 .5 IBM Websphere Application Server 5.0.2 .4 IBM Websphere Application Server 5.0.2 .3 BEA Systems WebLogic Server for Win32 8.1 SP 1 BEA Systems WebLogic Server for Win32 8.1 BEA Systems Weblogic Server 8.1 SP 1 BEA Systems Weblogic Server 8.1 Apache Tomcat 4.1.24 Apache Apache 2.0.48 Apache Apache 2.0.47 Apache Apache 2.0.46 Apache Apache 2.0.45 Apache Apache 2.0.44 Apache Apache 2.0.43 Apache Apache 2.0.42 Apache Apache 2.0.41 Apache Apache 2.0.40 Apache Apache 2.0.39 Apache Apache 2.0.38 Apache Apache 2.0.37 Apache Apache 2.0.36 Apache Apache 2.0.35 Apache Apache 2.0.32 Apache Apache 2.0.28 Apache Apache 2.0 |
| Not Vulnerable: | |
Discussion
Multiple Vendor HTTP Response Splitting Vulnerability
A paper (Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics) was released to describe various attacks that target web users through web application, browser, web/application server and proxy implementations. These attacks are described under the general category of HTTP Response Splitting and involve abusing various input validation flaws in these implementations to split HTTP responses into multiple parts in such a way that response data may be misrepresented to client users.
Exploitation would occur by injecting variations of CR/LF sequences into parts of HTTP response headers that the attacker may control or influence. The general consequences of exploitation are that an attacker may misrepresent web content to the client, potentially enticing the user to trust the content and take actions based on this false trust.
While the various implementations listed in the paper contribute to these attacks, this issue will most likely be exposed through web applications that do not properly account for CR/LF sequences when accepting user-supplied input that may be returned in server responses.
This vulnerability could also aid in exploitation of cross-site scripting vulnerabilities.
A paper (Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics) was released to describe various attacks that target web users through web application, browser, web/application server and proxy implementations. These attacks are described under the general category of HTTP Response Splitting and involve abusing various input validation flaws in these implementations to split HTTP responses into multiple parts in such a way that response data may be misrepresented to client users.
Exploitation would occur by injecting variations of CR/LF sequences into parts of HTTP response headers that the attacker may control or influence. The general consequences of exploitation are that an attacker may misrepresent web content to the client, potentially enticing the user to trust the content and take actions based on this false trust.
While the various implementations listed in the paper contribute to these attacks, this issue will most likely be exposed through web applications that do not properly account for CR/LF sequences when accepting user-supplied input that may be returned in server responses.
This vulnerability could also aid in exploitation of cross-site scripting vulnerabilities.
Exploit / POC
Multiple Vendor HTTP Response Splitting Vulnerability
In many cases there would no exploit required other than injecting CR/LF sequences into vulnerable web application input fields or other vectors that may permit an attacker to directly or indirectly influence HTTP response headers.
In many cases there would no exploit required other than injecting CR/LF sequences into vulnerable web application input fields or other vectors that may permit an attacker to directly or indirectly influence HTTP response headers.
Solution / Fix
Multiple Vendor HTTP Response Splitting Vulnerability
Solution:
IBM has released an advisory (Reference #:4007467) to address this issue in WebSphere Application Server. Please see the referenced advisory for more information. Users can dowload fixes through the UpdateInstaller.
A patch for Squid Proxy has been released dealing with this issue.
Squid Web Proxy Cache 2.5 .STABLE7
Solution:
IBM has released an advisory (Reference #:4007467) to address this issue in WebSphere Application Server. Please see the referenced advisory for more information. Users can dowload fixes through the UpdateInstaller.
A patch for Squid Proxy has been released dealing with this issue.
Squid Web Proxy Cache 2.5 .STABLE7
-
Squid squid-2.5.STABLE7-response_splitting.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-resp onse_splitting.patch
References
Multiple Vendor HTTP Response Splitting Vulnerability
References:
References: