NVD

Id
13097  
Name
CVE-2010-1576  
Description
The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-07-06  
Modified Date
2010-07-20  
Seq
2010-1576  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
72345 13097 CVE-2010-1576 1024167  View
72346 13097 CVE-2010-1576 1024168  View
72347 13097 CVE-2010-1576 20100702 VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities  View
72348 13097 CVE-2010-1576 41315  View
72349 13097 CVE-2010-1576 http://www.vsecurity.com/resources/advisory/20100702-1/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35949 JVNDB-2010-001729 Cisco Content Services Switch における HTTP Request Smuggling 攻撃の脆弱性 Cisco Content Services Switch (CSS) および Application Control Engine (ACE) には、HTTP ヘッダ間の CRLF シーケンスの代用となる LF、CR および LFCR の使用を適切に処理しないため、ヘッダの挿入を回避される、または HTTP Request Smuggling 攻撃の脆弱性が存在します。 CVE-2010-1576 44156 CVE-2010-1576 13097 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001729.html 2010-07-02 2010-07-27 View