CVE-2008-0456

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Link	Resource
http://www.mindedsecurity.com/MSA01150108.html	Broken Link
http://www.securityfocus.com/bid/27409	Third Party Advisory VDB Entry
http://securitytracker.com/id?1019256	Broken Link Third Party Advisory
http://security.gentoo.org/glsa/glsa-200803-19.xml	Third Party Advisory
http://secunia.com/advisories/29348	Not Applicable Third Party Advisory
http://securityreason.com/securityalert/3575	Exploit Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297	Permissions Required Third Party Advisory
http://secunia.com/advisories/35074	Not Applicable Third Party Advisory
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	Broken Link Mailing List
http://support.apple.com/kb/HT3549	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.html	Third Party Advisory US Government Resource
http://rhn.redhat.com/errata/RHSA-2013-0130.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/486847/100/0/threaded	VDB Entry Third Party Advisory
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E	Mailing List Vendor Advisory

Configuration 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

---

Published : 2008-01-25 01:00

Updated : 2022-09-21 07:08

---

NVD link : CVE-2008-0456

Mitre link : CVE-2008-0456

No products.

CWE-74