CVE-2005-2700

mod_ssl <2.8.24 - Privilege Escalation

Title source: llm
STIX 2.1

Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

References (64)

Core 64
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
https://lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16705
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2005/dsa-807
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=112870296926652&w=2
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-608.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16700
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17813
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16743
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16753
Third Party Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/2659
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17088
Broken Link vendor-advisory x_refsource_trustix
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22523
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2005_51_apache2.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16748
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-177-1
Vendor Advisory x_refsource_confirm
http://people.apache.org/~jorton/CAN-2005-2700.diff
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16754
Broken Link vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2005:161
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-773.html
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-816.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16789
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16714
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16769
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4207
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17288
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16956
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19072
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21848
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/19188
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/1625
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16771
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16746
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200509-12.xml
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2005_52_apache2.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2005/dsa-805
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/14721
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19073
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://marc.info/?l=apache-modssl&m=112569517603897&w=2
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/744929
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_openpkg
http://marc.info/?l=bugtraq&m=112604765028607&w=2
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16864
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17311
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/0789

Scores

EPSS 0.3058
EPSS Percentile 98.0%

Details

Status published
Products (5)
apache/http_server 2.0.35 - 2.0.55
canonical/ubuntu_linux 4.10
canonical/ubuntu_linux 5.04
debian/debian_linux 3.0
debian/debian_linux 3.1
Published Sep 06, 2005
Tracked Since Feb 18, 2026