+++ This bug was initially created as a clone of Bug #204048 +++ In May 2006 a reporter found a bug in Apache where an invalid Expect header sent to the server (Apache 1.3.3 onwards) would be returned to the user in an error message, unescaped. This could allow a cross-site scripting attack only if a victim can tricked into connecting to a site and sending such a carefully crafted Expect header. Whist browsers do not provide this functionality, it was recently discovered that Flash allows you to make a connection with arbitrary headers. The attack mechanism is therefore: 1. User is tricked into visiting a malicious web site with a flash-enabled browser 2. Malicious web site uses a flash movie to make a connection to the target site with custom Expect header 3. This results in cross-site scripting (attacker could steal your cookies from the third party site, or inject content etc) On http 2.0 versions the cross-site scripting does not happen immediately, step is delayed until the Apache server times out. On a default installation this could be 2-5 minutes. Therefore the attack is less likely to succeed. Patch: http://svn.apache.org/viewcvs?rev=394965&view=rev [1.3] http://svn.apache.org/viewcvs?rev=395172&view=rev [2.0]
*** This bug has been marked as a duplicate of 207922 ***