cve-2010-1576
Vulnerability from cvelistv5
Published
2010-07-06 14:00
Modified
2024-08-07 01:28
Severity ?
Summary
The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.
References
ykramarz@cisco.comhttp://osvdb.org/66092
ykramarz@cisco.comhttp://securitytracker.com/id?1024167
ykramarz@cisco.comhttp://securitytracker.com/id?1024168
ykramarz@cisco.comhttp://www.securityfocus.com/archive/1/512144/100/0/threaded
ykramarz@cisco.comhttp://www.securityfocus.com/bid/41315
ykramarz@cisco.comhttp://www.vsecurity.com/resources/advisory/20100702-1/Exploit
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/66092
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1024167
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1024168
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/512144/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/41315
af854a3a-2127-422b-91ae-364da2661108http://www.vsecurity.com/resources/advisory/20100702-1/Exploit
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:28:41.990Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100702 VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/512144/100/0/threaded"
          },
          {
            "name": "1024167",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1024167"
          },
          {
            "name": "41315",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/41315"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.vsecurity.com/resources/advisory/20100702-1/"
          },
          {
            "name": "66092",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/66092"
          },
          {
            "name": "1024168",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1024168"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20100702 VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/512144/100/0/threaded"
        },
        {
          "name": "1024167",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1024167"
        },
        {
          "name": "41315",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/41315"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.vsecurity.com/resources/advisory/20100702-1/"
        },
        {
          "name": "66092",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/66092"
        },
        {
          "name": "1024168",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1024168"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2010-1576",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100702 VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/512144/100/0/threaded"
            },
            {
              "name": "1024167",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1024167"
            },
            {
              "name": "41315",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/41315"
            },
            {
              "name": "http://www.vsecurity.com/resources/advisory/20100702-1/",
              "refsource": "MISC",
              "url": "http://www.vsecurity.com/resources/advisory/20100702-1/"
            },
            {
              "name": "66092",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/66092"
            },
            {
              "name": "1024168",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1024168"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2010-1576",
    "datePublished": "2010-07-06T14:00:00",
    "dateReserved": "2010-04-27T00:00:00",
    "dateUpdated": "2024-08-07T01:28:41.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:content_services_switch_11500:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"8.20.3.03\", \"matchCriteriaId\": \"522CC12B-058D-4711-8A04-AAC81A460B2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:content_services_switch_11500:8.20.0.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"934D3A1C-7723-4250-BC86-5921572AB358\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:content_services_switch_11500:08.20.1.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63BA31CE-19C7-4FDB-8A0A-F1C252EC6146\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:content_services_switch_11500:8.20.1.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"545E9F44-A61F-4037-9BDF-5DE7F8E506B6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:content_services_switch_11500:8.20.2.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7241A8A3-C8C8-44CA-990F-BDA47EB75D64\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:ace_4710:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"a3\\\\(2.5\\\\)\", \"matchCriteriaId\": \"B3FF387C-79BE-481C-A461-D32DCF421CC1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:ace_4710:a1\\\\(2.0\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"142B1472-4694-436F-85C0-52B6A9CFCA64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:cisco:ace_4710:a1\\\\(8.0\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A421567F-1772-46DC-9FBA-E0072DC6B7C6\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.\"}, {\"lang\": \"es\", \"value\": \"El Content Services Switch Cisco (CSS) 11500 con software anterios a  v8.20.4.02 y el Application Control Engine (ACE) 4710 con software anterior a vA2(3.0) no gestiona adecuadamente el uso de LF, CR y LFCR como alternativas a la secuencia estandar CRLF entre cabeceras HTTP, lo cual permite a los atacantes remotos evitar las restricciones de inserciones de cabecera HTTP o llevar a cabo ataques de contrabando a trav\\u00e9s de cabeceras de datos manipuladas, como lo demuestra el caracter LF precediendo a las cabeceras ClientCert-Subject y ClientCert-Subject-CN, tambi\\u00e9n conocido como Bug ID CSCta04885.\"}]",
      "id": "CVE-2010-1576",
      "lastModified": "2024-11-21T01:14:43.387",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2010-07-06T17:17:13.233",
      "references": "[{\"url\": \"http://osvdb.org/66092\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://securitytracker.com/id?1024167\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://securitytracker.com/id?1024168\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://www.securityfocus.com/archive/1/512144/100/0/threaded\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://www.securityfocus.com/bid/41315\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://www.vsecurity.com/resources/advisory/20100702-1/\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://osvdb.org/66092\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securitytracker.com/id?1024167\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securitytracker.com/id?1024168\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/512144/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/41315\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vsecurity.com/resources/advisory/20100702-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2010-1576\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2010-07-06T17:17:13.233\",\"lastModified\":\"2024-11-21T01:14:43.387\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.\"},{\"lang\":\"es\",\"value\":\"El Content Services Switch Cisco (CSS) 11500 con software anterios a  v8.20.4.02 y el Application Control Engine (ACE) 4710 con software anterior a vA2(3.0) no gestiona adecuadamente el uso de LF, CR y LFCR como alternativas a la secuencia estandar CRLF entre cabeceras HTTP, lo cual permite a los atacantes remotos evitar las restricciones de inserciones de cabecera HTTP o llevar a cabo ataques de contrabando a trav\u00e9s de cabeceras de datos manipuladas, como lo demuestra el caracter LF precediendo a las cabeceras ClientCert-Subject y ClientCert-Subject-CN, tambi\u00e9n conocido como Bug ID CSCta04885.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:content_services_switch_11500:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.20.3.03\",\"matchCriteriaId\":\"522CC12B-058D-4711-8A04-AAC81A460B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:content_services_switch_11500:8.20.0.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"934D3A1C-7723-4250-BC86-5921572AB358\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:content_services_switch_11500:08.20.1.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63BA31CE-19C7-4FDB-8A0A-F1C252EC6146\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:content_services_switch_11500:8.20.1.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"545E9F44-A61F-4037-9BDF-5DE7F8E506B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:content_services_switch_11500:8.20.2.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7241A8A3-C8C8-44CA-990F-BDA47EB75D64\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:ace_4710:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"a3\\\\(2.5\\\\)\",\"matchCriteriaId\":\"B3FF387C-79BE-481C-A461-D32DCF421CC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:ace_4710:a1\\\\(2.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142B1472-4694-436F-85C0-52B6A9CFCA64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:cisco:ace_4710:a1\\\\(8.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A421567F-1772-46DC-9FBA-E0072DC6B7C6\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/66092\",\"source\":\"ykramarz@cisco.com\"},{\"url\":\"http://securitytracker.com/id?1024167\",\"source\":\"ykramarz@cisco.com\"},{\"url\":\"http://securitytracker.com/id?1024168\",\"source\":\"ykramarz@cisco.com\"},{\"url\":\"http://www.securityfocus.com/archive/1/512144/100/0/threaded\",\"source\":\"ykramarz@cisco.com\"},{\"url\":\"http://www.securityfocus.com/bid/41315\",\"source\":\"ykramarz@cisco.com\"},{\"url\":\"http://www.vsecurity.com/resources/advisory/20100702-1/\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Exploit\"]},{\"url\":\"http://osvdb.org/66092\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1024167\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1024168\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/512144/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/41315\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vsecurity.com/resources/advisory/20100702-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.