CVE-2006-3918: apache http_server

Modified

AliasesRHSA-2006:0619DEBIAN-CVE-2006-3918

Published 28-07-2006Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2006-3918 is a medium (CVSS 4.3) vulnerability in apache http_server. EPSS estimates a 95.14% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 5 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 24-08-2006)

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

95.14%

0%100%

Critical · +0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits5reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 3

DSA-1167-1 RHSA-2008:0523 RHSA-2010:0602

Timeline

28-07-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

95.14%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 95.10% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found

referenceUnverified
Exploit Reference (svn.apache.org)
Maturity: unknown
referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown

Show all 5 exploits

referenceUnverified
Exploit Reference (securityreason.com)
Maturity: unknown
exploit-databaseremotelinuxVerified
Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat8 products

enterprise_linux_server2.0
enterprise_linux_workstation2.0
httpd< 0:2.0.46-61.ent | < 0:2.0.52-28.ent
httpd-debuginfo< 0:2.0.46-61.ent | < 0:2.0.52-28.ent
httpd-devel< 0:2.0.46-61.ent | < 0:2.0.52-28.ent

Show all 8

Debian2 products

apache2< 2.0.55-4.1
debian_linuxEOL3.1

Apache1 product

http_server≥ 1.3.3, < 1.3.35

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04 | 7.10

4 vendors · 12 products

References

63 links

www.vupen.com/english/advisories/2010/1572VDB EntryX Refsource VUPENPermissions Required
svn.apache.org/viewvc?view=rev&revision=394965X Refsource CONFIRMExploitVendor Advisory
secunia.com/advisories/28749Third Party AdvisoryX Refsource SECUNIANot Applicable
www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.htmlX Refsource CONFIRMThird Party Advisory
www.debian.org/security/2006/dsa-1167Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/19661VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/21744Third Party AdvisoryX Refsource SECUNIANot Applicable
archives.neohapsis.com/archives/bugtraq/2006-07/0425.htmlMailing ListX Refsource BUGTRAQBroken LinkExploit
marc.info?l=bugtraq&m=125631037611762&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.securitytracker.com/id?1024144VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory

Show all 63 references

secunia.com/advisories/22317Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/22523Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=130497311408250&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.vupen.com/english/advisories/2006/5089VDB EntryX Refsource VUPENPermissions Required
www.vupen.com/english/advisories/2006/3264VDB EntryX Refsource VUPENPermissions Required
archives.neohapsis.com/archives/bugtraq/2006-05/0151.htmlMailing ListX Refsource BUGTRAQBroken LinkExploit
secunia.com/advisories/21598Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/21399Third Party AdvisoryX Refsource SECUNIANot Applicable
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352VDB EntrySignatureX Refsource OVALThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2006-194.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/21478Third Party AdvisoryX Refsource SECUNIANot Applicable
www.redhat.com/support/errata/RHSA-2006-0619.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/21986Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117X Refsource CONFIRMBroken Link
www.vupen.com/english/advisories/2006/4207VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/21848Third Party AdvisoryX Refsource SECUNIANot Applicable
rhn.redhat.com/errata/RHSA-2006-0618.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www-1.ibm.com/support/docview.wss?uid=swg1PK24631Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2006-0692.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/40256Third Party AdvisoryX Refsource SECUNIANot Applicable
www.novell.com/linux/security/advisories/2006_51_apache.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.vupen.com/english/advisories/2006/2963VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/21174Third Party AdvisoryX Refsource SECUNIANot ApplicablePatchVendor Advisory
www.ubuntu.com/usn/usn-575-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/29640Third Party AdvisoryX Refsource SECUNIANot Applicable
securityreason.com/securityalert/1294Third Party AdvisoryX Refsource SREASONExploit
openbsd.org/errata.htmlVendor AdvisoryX Refsource OPENBSDThird Party Advisory
www-1.ibm.com/support/docview.wss?uid=swg24013080Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
secunia.com/advisories/21172Third Party AdvisoryX Refsource SECUNIANot ApplicablePatchVendor Advisory
kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.htmlX Refsource CONFIRMThird Party Advisory
securitytracker.com/id?1016569VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.vupen.com/english/advisories/2006/2964VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/22140Third Party AdvisoryX Refsource SECUNIANot Applicable
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
access.redhat.com/errata/RHSA-2006:0619Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=200732REPORT
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0619.jsonAdvisory
access.redhat.com/security/cve/CVE-2006-3918REPORT
www.cve.org/CVERecord?id=CVE-2006-3918Advisory
nvd.nist.gov/vuln/detail/CVE-2006-3918Advisory
security-tracker.debian.org/tracker/CVE-2006-3918Advisory