CVE-2013-5704

Public Exploit

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 79.08% Top 5%

Vendor Advisory marc.info Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory apache.org Vendor Advisory apache.org Vendor Advisory apache.org Vendor Advisory apache.org

Affected: n/a n/a

References

Link	Tags
http://marc.info/?l=bugtraq&m=144493176821532&w=2	issue tracking mailing list third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	third party advisory
https://support.apple.com/HT204659	third party advisory
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES	release notes vendor advisory
https://security.gentoo.org/glsa/201504-03	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2015-1249.html	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2016-0061.html	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2015-0325.html	third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:174	third party advisory vendor advisory
http://www.ubuntu.com/usn/USN-2523-1	third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	third party advisory
http://rhn.redhat.com/errata/RHSA-2016-0062.html	third party advisory vendor advisory
http://marc.info/?l=bugtraq&m=143403519711434&w=2	issue tracking mailing list third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html	third party advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246	third party advisory
http://rhn.redhat.com/errata/RHSA-2015-2661.html	broken link third party advisory vendor advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html	mailing list third party advisory vendor advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h	patch vendor advisory
https://access.redhat.com/errata/RHSA-2015:2659	third party advisory vendor advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c	patch vendor advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	third party advisory
https://access.redhat.com/errata/RHSA-2015:2660	third party advisory vendor advisory
https://httpd.apache.org/security/vulnerabilities_24.html	vendor advisory
http://martin.swende.se/blog/HTTPChunked.html	exploit third party advisory broken link
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	mailing list third party advisory vendor advisory
https://support.apple.com/HT205219	third party advisory
http://www.securityfocus.com/bid/66550	vdb entry third party advisory
http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2	third party advisory mailing list
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E	mailing list

Frequently Asked Questions

What is the severity of CVE-2013-5704?: CVE-2013-5704 has been scored as a medium severity vulnerability.
How to fix CVE-2013-5704?: To fix CVE-2013-5704, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2013-5704 being actively exploited in the wild?: It is possible that CVE-2013-5704 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~79% probability that this vulnerability will be exploited by malicious actors in the next 30 days.