ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Project Subscriptions

Vendors Products
Http Server Subscribe
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Linux Subscribe
Enterprise Linux Subscribe
Rhel Stronghold Subscribe
Stronghold Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2005-2701 ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Ubuntu USN Ubuntu USN USN-177-1 Apache 2 vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html cve-icon cve-icon
http://marc.info/?l=apache-modssl&m=112569517603897&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=112604765028607&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=112870296926652&w=2 cve-icon cve-icon
http://people.apache.org/~jorton/CAN-2005-2700.diff cve-icon cve-icon
http://secunia.com/advisories/16700 cve-icon cve-icon
http://secunia.com/advisories/16705 cve-icon cve-icon
http://secunia.com/advisories/16714 cve-icon cve-icon
http://secunia.com/advisories/16743 cve-icon cve-icon
http://secunia.com/advisories/16746 cve-icon cve-icon
http://secunia.com/advisories/16748 cve-icon cve-icon
http://secunia.com/advisories/16753 cve-icon cve-icon
http://secunia.com/advisories/16754 cve-icon cve-icon
http://secunia.com/advisories/16769 cve-icon cve-icon
http://secunia.com/advisories/16771 cve-icon cve-icon
http://secunia.com/advisories/16789 cve-icon cve-icon
http://secunia.com/advisories/16864 cve-icon cve-icon
http://secunia.com/advisories/16956 cve-icon cve-icon
http://secunia.com/advisories/17088 cve-icon cve-icon
http://secunia.com/advisories/17288 cve-icon cve-icon
http://secunia.com/advisories/17311 cve-icon cve-icon
http://secunia.com/advisories/17813 cve-icon cve-icon
http://secunia.com/advisories/19072 cve-icon cve-icon
http://secunia.com/advisories/19073 cve-icon cve-icon
http://secunia.com/advisories/21848 cve-icon cve-icon
http://secunia.com/advisories/22523 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 cve-icon cve-icon
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm cve-icon cve-icon
http://www.debian.org/security/2005/dsa-805 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-807 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200509-12.xml cve-icon cve-icon
http://www.kb.cert.org/vuls/id/744929 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2005:161 cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2005_51_apache2.html cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2005_52_apache2.html cve-icon cve-icon
http://www.osvdb.org/19188 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-608.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-773.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-816.html cve-icon cve-icon
http://www.securityfocus.com/bid/14721 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-177-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2005/1625 cve-icon cve-icon
http://www.vupen.com/english/advisories/2005/2659 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/0789 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4207 cve-icon cve-icon
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 cve-icon cve-icon
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195 cve-icon cve-icon
https://lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb%40%3Cdev.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5b1e7d66c5adf286f14f6cc0f857b6fca107444f68aed9e70eedab47%40%3Cdev.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2005-2700 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10416 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2005-2700 cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T22:45:01.906Z

Reserved: 2005-08-26T04:00:00.000Z

Link: CVE-2005-2700

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2005-09-06T23:03:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2005-2700

cve-icon Redhat

Severity : Important

Publid Date: 2005-08-30T00:00:00Z

Links: CVE-2005-2700 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses