CVE-2005-3058

Interpretation conflict in Fortinet FortiGate 2.8, running FortiOS 2.8MR10 and v3beta, allows remote attackers to bypass the URL blocker via an (1) HTTP request terminated with a line feed (LF) and not carriage return line feed (CRLF) or (2) HTTP request with no Host field, which is still processed by most web servers without violating RFC2616.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042140.html
http://secunia.com/advisories/18844	Vendor Advisory
http://www.securityfocus.com/bid/16599
http://www.fortiguard.com/advisory/FGA-2006-10.html
http://www.vupen.com/english/advisories/2006/0539	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24626
http://www.securityfocus.com/archive/1/424858/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::

Configuration 2 (hide)

cpe:2.3:h:fortinet:fortigate:2.8:*:*:*:*:*:*:*

Information

Published : 2005-12-30 21:00

Updated : 2018-10-19 08:34

NVD link : CVE-2005-3058

Mitre link : CVE-2005-3058

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

fortinet

fortios
fortigate

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042140.html", "name": "20060213 URL filter bypass in Fortinet", "tags": [], "refsource": "FULLDISC"}, {"url": "http://secunia.com/advisories/18844", "name": "18844", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/16599", "name": "16599", "tags": [], "refsource": "BID"}, {"url": "http://www.fortiguard.com/advisory/FGA-2006-10.html", "name": "http://www.fortiguard.com/advisory/FGA-2006-10.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2006/0539", "name": "ADV-2006-0539", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24626", "name": "fortinet-web-filter-bypass(24626)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/424858/100/0/threaded", "name": "20060213 URL filter bypass in Fortinet", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Interpretation conflict in Fortinet FortiGate 2.8, running FortiOS 2.8MR10 and v3beta, allows remote attackers to bypass the URL blocker via an (1) HTTP request terminated with a line feed (LF) and not carriage return line feed (CRLF) or (2) HTTP request with no Host field, which is still processed by most web servers without violating RFC2616."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-3058", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3_beta"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.8_mr10"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:fortinet:fortigate:2.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:34Z"}

7.5 /10