Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 200738 - CVE-2006-3918 Expect header XSS
CVE-2006-3918 Expect header XSS
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: httpd (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Joe Orton
: Security
Depends On:
  Show dependency treegraph
Reported: 2006-07-31 09:45 EDT by Mark J. Cox
Modified: 2007-11-30 17:06 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2006-0618
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-08 15:41:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0618 normal SHIPPED_LIVE Important: apache security update 2006-08-08 00:00:00 EDT

  None (edit)
Description Mark J. Cox 2006-07-31 09:45:09 EDT
+++ This bug was initially created as a clone of Bug #200732 +++

In May 2006 a reporter found a bug in Apache where an invalid Expect header sent
to the server (Apache 1.3.3 onwards) would be returned to the user in an error
message, unescaped.  This could allow a cross-site scripting attack only if a
victim can tricked into connecting to a site and sending such a carefully
crafted Expect header.  Whist browsers do not provide this functionality, it was
recently discovered that Flash allows you to make a connection with arbitrary
headers.  The attack mechanism is therefore:

1. User is tricked into visiting a malicious web site with a flash-enabled browser
2. Malicious web site uses a flash movie to make a connection to the target site
with custom Expect header
3. This results in cross-site scripting (attacker could steal your cookies from
the third party site, or inject content etc)

http://svn.apache.org/viewcvs?rev=394965&view=rev [1.3]
Comment 3 Red Hat Bugzilla 2006-08-08 15:41:32 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.