CVE-2005-2700 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2005-2700

CVE-2005-2700

September 06, 2005

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Related Resources (66)

http://secunia.com/advisories/16956

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/19072

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/16705

http://secunia.com/advisories/16748

http://secunia.com/advisories/16754

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117

http://www.kb.cert.org/vuls/id/744929

http://secunia.com/advisories/16746

http://www.redhat.com/support/errata/RHSA-2005-608.html

http://secunia.com/advisories/16864

https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/16743

http://www.mandriva.com/security/advisories?name=MDKSA-2005:161

http://www.vupen.com/english/advisories/2005/1625

http://www.debian.org/security/2005/dsa-805

http://www.osvdb.org/19188

http://secunia.com/advisories/21848

http://www.ubuntu.com/usn/usn-177-1

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/17288

https://security-tracker.debian.org/tracker/CVE-2005-2700

http://www.securityfocus.com/bid/14721

http://secunia.com/advisories/19073

https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1

http://secunia.com/advisories/17088

http://marc.info/?l=bugtraq&m=112870296926652&w=2

http://secunia.com/advisories/16753

http://www.novell.com/linux/security/advisories/2005_51_apache2.html

http://secunia.com/advisories/17813

http://marc.info/?l=apache-modssl&m=112569517603897&w=2

http://www.gentoo.org/security/en/glsa/glsa-200509-12.xml

http://secunia.com/advisories/16700

http://secunia.com/advisories/16714

https://people.canonical.com/~ubuntu-security/cve/CVE-2005-2700

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/16771

http://www.debian.org/security/2005/dsa-807

http://www.vupen.com/english/advisories/2005/2659

https://lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb%40%3Cdev.httpd.apache.org%3E

https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10416

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.html

http://people.apache.org/~jorton/CAN-2005-2700.diff

http://www.vupen.com/english/advisories/2006/4207

https://lists.apache.org/thread.html/5b1e7d66c5adf286f14f6cc0f857b6fca107444f68aed9e70eedab47%40%3Cdev.httpd.apache.org%3E

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195

http://secunia.com/advisories/17311

http://marc.info/?l=bugtraq&m=112604765028607&w=2

http://www.vupen.com/english/advisories/2006/0789

http://secunia.com/advisories/16789

http://www.novell.com/linux/security/advisories/2005_52_apache2.html

http://www.redhat.com/support/errata/RHSA-2005-773.html

http://www.redhat.com/support/errata/RHSA-2005-816.html

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

http://secunia.com/advisories/22523

http://secunia.com/advisories/16769

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1

Do you need more information?

CVSS v4

Base Score:

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

CVSS v2

Base Score:

10

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

EPSS

Base Score:

15.08