Bug 200738 - CVE-2006-3918 Expect header XSS
Summary: CVE-2006-3918 Expect header XSS
Alias: None
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: httpd   
(Show other bugs)
Version: 2.1
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Joe Orton
QA Contact:
Whiteboard: public=20060508,source=asf,impact=imp...
Keywords: Security
Depends On:
TreeView+ depends on / blocked
Reported: 2006-07-31 13:45 UTC by Mark J. Cox
Modified: 2007-11-30 22:06 UTC (History)
1 user (show)

Fixed In Version: RHSA-2006-0618
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-08 19:41:30 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0618 normal SHIPPED_LIVE Important: apache security update 2006-08-08 04:00:00 UTC

Description Mark J. Cox 2006-07-31 13:45:09 UTC
+++ This bug was initially created as a clone of Bug #200732 +++

In May 2006 a reporter found a bug in Apache where an invalid Expect header sent
to the server (Apache 1.3.3 onwards) would be returned to the user in an error
message, unescaped.  This could allow a cross-site scripting attack only if a
victim can tricked into connecting to a site and sending such a carefully
crafted Expect header.  Whist browsers do not provide this functionality, it was
recently discovered that Flash allows you to make a connection with arbitrary
headers.  The attack mechanism is therefore:

1. User is tricked into visiting a malicious web site with a flash-enabled browser
2. Malicious web site uses a flash movie to make a connection to the target site
with custom Expect header
3. This results in cross-site scripting (attacker could steal your cookies from
the third party site, or inject content etc)

http://svn.apache.org/viewcvs?rev=394965&view=rev [1.3]

Comment 3 Red Hat Bugzilla 2006-08-08 19:41:32 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.