Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
References
| Link | Resource |
|---|---|
| http://seclists.org/lists/bugtraq/2005/Jun/0025.html | Mailing List Third Party Advisory |
| http://www.securiteam.com/securityreviews/5GP0220G0U.html | Broken Link |
| http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf | Broken Link |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/42899 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
09 Feb 2024, 02:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:* | |
| References | () http://seclists.org/lists/bugtraq/2005/Jun/0025.html - Mailing List, Third Party Advisory | |
| References | () http://www.securiteam.com/securityreviews/5GP0220G0U.html - Broken Link | |
| References | () http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf - Broken Link | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/42899 - Third Party Advisory, VDB Entry | |
| CWE | CWE-444 |
Information
Published : 2005-07-05 04:00
Updated : 2024-02-09 02:29
NVD link : CVE-2005-2089
Mitre link : CVE-2005-2089
CVE.ORG link : CVE-2005-2089
JSON object : View
Products Affected
microsoft
- internet_information_services
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')