CVE-2005-2090

Public Exploit

Description

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 84.36% Top 5%

Vendor Advisory sun.com Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory hp.com Vendor Advisory redhat.com Vendor Advisory apache.org Vendor Advisory apache.org Vendor Advisory apache.org

Affected: n/a n/a

References

Link	Tags
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200703e.html	third party advisory
http://tomcat.apache.org/security-4.html	vendor advisory
http://secunia.com/advisories/30908	third party advisory permissions required
http://lists.vmware.com/pipermail/security-announce/2008/000003.html	third party advisory mailing list
http://www.vupen.com/english/advisories/2007/2732	vdb entry permissions required
http://www.securityfocus.com/bid/13873	vdb entry third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1	vendor advisory broken link
http://www.vupen.com/english/advisories/2007/3087	vdb entry permissions required
http://secunia.com/advisories/30899	third party advisory permissions required
http://secunia.com/advisories/29242	third party advisory permissions required
http://www.vupen.com/english/advisories/2008/1979/references	vdb entry permissions required
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	mailing list third party advisory vendor advisory
http://www.vupen.com/english/advisories/2008/0065	vdb entry permissions required
http://www.securityfocus.com/archive/1/500412/100/0/threaded	mailing list vdb entry third party advisory
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html	third party advisory vendor advisory
http://secunia.com/advisories/33668	third party advisory permissions required
http://www.securityfocus.com/archive/1/485938/100/0/threaded	mailing list vdb entry third party advisory
http://www.securityfocus.com/archive/1/500396/100/0/threaded	mailing list vdb entry third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0360.html	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2009/0233	vdb entry permissions required
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10499	vdb entry third party advisory signature
http://secunia.com/advisories/28365	third party advisory permissions required
http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm	third party advisory
http://tomcat.apache.org/security-6.html	vendor advisory
http://www.vupen.com/english/advisories/2007/3386	vdb entry permissions required
http://www.securiteam.com/securityreviews/5GP0220G0U.html	third party advisory exploit
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf	third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0327.html	third party advisory vendor advisory
http://secunia.com/advisories/27037	third party advisory permissions required
http://securitytracker.com/id?1014365	vdb entry third party advisory
http://docs.info.apple.com/article.html?artnum=306172	broken link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor advisory broken link
http://tomcat.apache.org/security-5.html	vendor advisory
http://www.securityfocus.com/bid/25159	vdb entry third party advisory
http://secunia.com/advisories/26660	third party advisory permissions required
http://www.redhat.com/support/errata/RHSA-2008-0261.html	third party advisory vendor advisory
http://seclists.org/lists/bugtraq/2005/Jun/0025.html	third party advisory mailing list
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	broken link
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	third party advisory broken link
http://secunia.com/advisories/26235	third party advisory permissions required
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E	mailing list

Frequently Asked Questions

What is the severity of CVE-2005-2090?: CVE-2005-2090 has been scored as a medium severity vulnerability.
How to fix CVE-2005-2090?: To fix CVE-2005-2090, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-2090 being actively exploited in the wild?: It is possible that CVE-2005-2090 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~84% probability that this vulnerability will be exploited by malicious actors in the next 30 days.