Bug 162245

Summary:	CAN-2005-2088 httpd proxy request smuggling
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	httpd	Assignee:	Joe Orton <jorton>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4	CC:	jam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	public=20050612,impact=moderate
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-08-03 15:00:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-07-01 13:39:51 UTC

+++ This bug was initially created as a clone of Bug #162244 +++

When using apache as a proxy, it is vulnerable to request smuggling.

(taken from bugtraq)
http://seclists.org/lists/bugtraq/2005/Jun/0025.html

> "We describe a new web entity attack technique ï¿½ ï¿½HTTP Request
> Smugglingï¿½. The attack technique and the derived attacks are relevant
> to most web environments and is the result of a HTTP server or
> deviceï¿½s failure to properly handle malformed inbound HTTP requests.
> HTTP Request Smuggling works by taking advantage of the discrepancies
> in parsing when one or more HTTP devices/entities (e.g. Cache Server,
> Proxy Server, Web Application Firewall, etc.) are in the data flow
> between the user and the web server. HTTP Request Smuggling enables
> various attacks ï¿½ web cache poisoning, session hijacking, cross-site
> scripting and most serious the ability to bypass web application
> firewall protection.

http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf

Comment 1 Josh Bressers 2005-07-01 13:41:23 UTC

This issue also affects FC3

Comment 2 Joe Orton 2005-08-03 15:00:32 UTC

Fixed in FEDORA-2005-638, FEDORA-2005-639:

http://www.redhat.com/archives/fedora-announce-list/2005-August/msg00004.html
http://www.redhat.com/archives/fedora-announce-list/2005-August/msg00006.html