National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2005-2728 Detail

Description

The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.

Source:  MITRE      Last Modified:  08/30/2005

Quick Info

CVE Dictionary Entry:
CVE-2005-2728
Original release date:
08/30/2005
Last revised:
10/10/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
5.0 MEDIUM
Vector:
(AV:N/AC:L/Au:N/C:N/I:N/A:P) (legend)
Impact Subscore:
2.9
Exploitability Subscore:
10.0
CVSS Version 2 Metrics:
Access Vector:
Network exploitable
Access Complexity:
Low
Authentication:
Not required to exploit
Impact Type:
Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.55: http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U External Source SGI 20060101-01-U
http://issues.apache.org/bugzilla/show_bug.cgi?id=29962 Patch; Vendor Advisory External Source CONFIRM http://issues.apache.org/bugzilla/show_bug.cgi?id=29962
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html External Source TRUSTIX TSLSA-2005-0059
http://securityreason.com/securityalert/604 External Source SREASON 604
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 External Source SUNALERT 102198
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm External Source CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
http://www.debian.org/security/2005/dsa-805 External Source DEBIAN DSA-805
http://www.gentoo.org/security/en/glsa/glsa-200508-15.xml Patch; Vendor Advisory External Source GENTOO GLSA-200508-15
http://www.mandriva.com/security/advisories?name=MDKSA-2005:161 External Source MANDRIVA MDKSA-2005:161
http://www.novell.com/linux/security/advisories/2005_51_apache2.html External Source SUSE SUSE-SA:2005:051
http://www.novell.com/linux/security/advisories/2005_52_apache2.html External Source SUSE SUSE-SA:2005:052
http://www.redhat.com/support/errata/RHSA-2005-608.html External Source REDHAT RHSA-2005:608
http://www.securityfocus.com/archive/1/archive/1/428138/100/0/threaded External Source HP HPSBUX02074
http://www.securityfocus.com/bid/14660 Patch External Source BID 14660
http://www.ubuntu.com/usn/usn-177-1 External Source UBUNTU USN-177-1
http://www.vupen.com/english/advisories/2006/0789 External Source VUPEN ADV-2006-0789
https://exchange.xforce.ibmcloud.com/vulnerabilities/22006 External Source XF apache-byterange-dos(22006)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10017 External Source OVAL oval:org.mitre.oval:def:10017
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1246 External Source OVAL oval:org.mitre.oval:def:1246
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1727 External Source OVAL oval:org.mitre.oval:def:1727
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A760 External Source OVAL oval:org.mitre.oval:def:760

References to Check Content

Identifier:
oval:org.mitre.oval:def:10017
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10017
Identifier:
oval:org.mitre.oval:def:1246
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1246
Identifier:
oval:org.mitre.oval:def:1727
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1727
Identifier:
oval:org.mitre.oval:def:760
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:760

Technical Details

Vulnerability Type (View All)

Change History 4 change records found - show changes