NVD

Id
68389  
Name
CVE-2005-2700  
Description
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2005-09-06  
Modified Date
2016-11-21  
Seq
2005-2700  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
353303 68389 CVE-2005-2700 TSLSA-2005-0059  View
353304 68389 CVE-2005-2700 [apache-modssl] 20050902 [ANNOUNCE] mod_ssl 2.8.24-1.3.33  View
353305 68389 CVE-2005-2700 OpenPKG-SA-2005.017  View
353306 68389 CVE-2005-2700 SSRT051043  View
353307 68389 CVE-2005-2700 oval:org.mitre.oval:def:10416  View
353308 68389 CVE-2005-2700 http://people.apache.org/~jorton/CAN-2005-2700.diff  View
353309 68389 CVE-2005-2700 102197  View
353310 68389 CVE-2005-2700 102198  View
353311 68389 CVE-2005-2700 http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm  View
353312 68389 CVE-2005-2700 DSA-805  View
353313 68389 CVE-2005-2700 DSA-807  View
353314 68389 CVE-2005-2700 GLSA-200509-12  View
353315 68389 CVE-2005-2700 VU#744929  View
353316 68389 CVE-2005-2700 MDKSA-2005:161  View
353317 68389 CVE-2005-2700 SUSE-SA:2005:051  View
353318 68389 CVE-2005-2700 SUSE-SA:2005:052  View
353319 68389 CVE-2005-2700 RHSA-2005:608  View
353320 68389 CVE-2005-2700 RHSA-2005:773  View
353321 68389 CVE-2005-2700 RHSA-2005:816  View
353322 68389 CVE-2005-2700 14721  View
353323 68389 CVE-2005-2700 USN-177-1  View
353324 68389 CVE-2005-2700 ADV-2005-1625  View
353325 68389 CVE-2005-2700 ADV-2005-2659  View
353326 68389 CVE-2005-2700 ADV-2006-0789  View
353327 68389 CVE-2005-2700 ADV-2006-4207  View
353328 68389 CVE-2005-2700 http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117  View
353329 68389 CVE-2005-2700 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195  View
353330 68389 CVE-2005-2700 SuSE-SA:2006:051  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
62306 JVNDB-2005-000508 Apache HTTP Server に含まれる mod_ssl の ssl_hook_Access() 関数における認証回避の脆弱性 Apache HTTP Server に含まれる mod_ssl では、ssl_engine_kernel.c に実装されている ssl_hook_Access() 関数に不備が存在するため、バーチャルホストのグローバル設定で SSLVerifyClient optional が設定されている状況下において、Location セクションごとに SSLVerifyClient require が設定されていた場合、クライアント証明書による認証が適切に行われない脆弱性が存在します。 CVE-2005-2700 13904 CVE-2005-2700 68389 10 http://jvndb.jvn.jp/ja/contents/2005/JVNDB-2005-000508.html 2005-08-30 2007-04-01 View