National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2005-3352 Detail

Current Description

Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.

Source:  MITRE      Last Modified:  12/13/2005      View Analysis Description

Quick Info

CVE Dictionary Entry:
CVE-2005-3352
Original release date:
12/13/2005
Last revised:
10/10/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
4.3 MEDIUM
Vector:
(AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore:
2.9
Exploitability Subscore:
8.6
CVSS Version 2 Metrics:
Access Vector:
Network exploitable
Access Complexity:
Medium
Authentication:
Not required to exploit
Impact Type:
Allows unauthorized modification

Vendor Statements (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.2.2, 2.0.58, and 1.3.35: http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_13.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U External Source SGI 20060101-01-U
http://docs.info.apple.com/article.html?artnum=307562 External Source CONFIRM http://docs.info.apple.com/article.html?artnum=307562
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449 External Source HP HPSBMA02328
http://issues.apache.org/bugzilla/show_bug.cgi?id=37874 External Source CONFIRM http://issues.apache.org/bugzilla/show_bug.cgi?id=37874
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html External Source APPLE APPLE-SA-2008-05-28
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html External Source APPLE APPLE-SA-2008-03-18
http://lists.suse.com/archive/suse-security-announce/2007-May/0005.html External Source SUSE SUSE-SR:2007:011
http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html External Source SUSE SUSE-SR:2006:004
http://marc.info/?l=bugtraq&m=130497311408250&w=2 External Source HP HPSBOV02683
http://rhn.redhat.com/errata/RHSA-2006-0159.html External Source REDHAT RHSA-2006:0159
http://rhn.redhat.com/errata/RHSA-2006-0692.html External Source REDHAT RHSA-2006:0692
http://securitytracker.com/id?1015344 Patch External Source SECTRACK 1015344
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.470158 External Source SLACKWARE SSA:2006-130-01
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.685483 External Source SLACKWARE SSA:2006-129-01
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1 External Source SUNALERT 102662
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102663-1 External Source SUNALERT 102663
http://www.debian.org/security/2006/dsa-1167 External Source DEBIAN DSA-1167
http://www.gentoo.org/security/en/glsa/glsa-200602-03.xml External Source GENTOO GLSA-200602-03
http://www.novell.com/linux/security/advisories/2006_43_apache.html External Source SUSE SUSE-SA:2006:043
http://www.openpkg.org/security/OpenPKG-SA-2005.029-apache.txt External Source OPENPKG OpenPKG-SA-2005.029
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html External Source CONFIRM http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00060.html External Source FEDORA FEDORA-2006-052
http://www.redhat.com/support/errata/RHSA-2006-0158.html External Source REDHAT RHSA-2006:0158
http://www.securityfocus.com/archive/1/archive/1/425399/100/0/threaded External Source FEDORA FLSA-2006:175406
http://www.securityfocus.com/archive/1/archive/1/445206/100/0/threaded External Source HP SSRT061202
http://www.securityfocus.com/archive/1/archive/1/450315/100/0/threaded External Source HP HPSBUX02172
http://www.securityfocus.com/archive/1/archive/1/450321/100/0/threaded External Source HP SSRT061265
http://www.securityfocus.com/bid/15834 External Source BID 15834
http://www.trustix.org/errata/2005/0074/ External Source TRUSTIX TSLSA-2005-0074
http://www.ubuntulinux.org/usn/usn-241-1 External Source UBUNTU USN-241-1
http://www.us-cert.gov/cas/techalerts/TA08-150A.html US Government Resource External Source CERT TA08-150A
http://www.vupen.com/english/advisories/2005/2870 External Source VUPEN ADV-2005-2870
http://www.vupen.com/english/advisories/2006/2423 External Source VUPEN ADV-2006-2423
http://www.vupen.com/english/advisories/2006/3995 External Source VUPEN ADV-2006-3995
http://www.vupen.com/english/advisories/2006/4015 External Source VUPEN ADV-2006-4015
http://www.vupen.com/english/advisories/2006/4300 External Source VUPEN ADV-2006-4300
http://www.vupen.com/english/advisories/2006/4868 External Source VUPEN ADV-2006-4868
http://www.vupen.com/english/advisories/2008/0924/references External Source VUPEN ADV-2008-0924
http://www.vupen.com/english/advisories/2008/1246/references External Source VUPEN ADV-2008-1246
http://www.vupen.com/english/advisories/2008/1697 External Source VUPEN ADV-2008-1697
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only External Source AIXAPAR PK16139
http://www-1.ibm.com/support/search.wss?rs=0&q=PK25355&apar=only External Source AIXAPAR PK25355
http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:007 External Source MANDRIVA MDKSA-2006:007
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10480 External Source OVAL oval:org.mitre.oval:def:10480

References to Check Content

Identifier:
oval:org.mitre.oval:def:10480
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10480

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.7:*:dev:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.11:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.12:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.13:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.14:*:mac_os:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.14:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.15:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.16:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.17:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.18:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.19:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.20:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.22:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.23:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.24:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.25:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.26:*:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_imap:*:*:*:*:*:*:*:*

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 2 change records found - show changes