Serendipity response splitting attack
| serendipity-response-splitting (17798) |  Medium Risk |
Description:
Serendipity is vulnerable to an HTTP response splitting attack. A remote attacker could send a specially-crafted request to cause the server to return a split response, which would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtaining sensitive information.
Platforms Affected:
- s9y, Serendipity prior to 0.7-rc1
Remedy:
Upgrade to the latest version of Serendipity (0.7-rc1 or later), available from the SourceForge.net Web site. See References.
Consequences:
Obtain Information
References:
- BugTraq Mailing List, Thu Oct 21 2004 - 13:41:50 CDT, HTTP Response Splitting in Serendipity 0.7-beta4 at http://archives.neohapsis.com/archives/bugtraq/2004-10/0219.html.
- File Release Notes and Changelog, Release Name: 0.7-rc1 at http://sourceforge.net/project/shownotes.php?release_id=276694.
- Serendipity Web page, Serendipity - a PHP Weblog/Blog software at http://www.s9y.org/1.html.
- SourceForge.net, Project: Serendipity PHP Weblog System: Summary at http://sourceforge.net/projects/php-blog/.
- BID-11497: Serendipity Exit.PHP HTTP Response Splitting Vulnerability
- CVE-2004-1620: CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.
- OSVDB ID: 11013: Serendipity index.php Requested URL HTTP Response Splitting
- OSVDB ID: 11038: Serendipity comments.php Referrer Field HTTP Response Splitting
- OSVDB ID: 11039: Serendipity exit.php url Variable HTTP Response Splitting
- SA12909: Serendipity Unspecified HTTP Response Splitting Vulnerability
- SECTRACK ID: 1011864: Serendipity Input Validation Flaws in Processing Request URI and HTTP Referer Field May Permit HTTP Response Splitting Attacks
Reported:
Oct 21, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net