IBM HTTP Server "Expect" Header Cross-Site Scripting - Advisories

IBM HTTP Server "Expect" Header Cross-Site Scripting

Secunia Advisory:	SA21174
Release Date:	2006-07-25
Last Update:	2007-11-13

Critical:	Less critical
Impact:	Cross Site Scripting
Where:	From remote
Solution Status:	Vendor Patch

Software:	IBM HTTP Server 1.x IBM HTTP Server 2.x IBM HTTP Server 6.0.x IBM HTTP Server 6.1.x

CVE reference:	CVE-2006-3918 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: IBM has acknowledged a vulnerability in IBM HTTP Server, which can be exploited by malicious people to conduct cross-site scripting attacks. For more information: SA21172 Solution: Apply fixes. Version 6.1: Update to version 6.1.0.1 or later. Version 6.0: Update to version 6.0.2.13 or later. Version 2.0: Apply APAR PK25355 or later. Version 1.3: Apply APAR PK27875 or later. Changelog: 2006-08-11: Added CVE reference. 2007-11-13: Updated "Solution" section and added version 1.x as additional affected software version. Original Advisory: IBM: http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631 Other References: SA21172: http://secunia.com/advisories/21172/



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

20 Related Secunia Security Advisories, displaying 10

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Opera Multiple Vulnerabilities

2.	Sun Solaris NFSv4 Client Kernel Module Denial of Service

3.	Banner Management "id" SQL Injection Vulnerability

4.	Avaya CMS Solaris "picld" Denial of Service

5.	Active PHP Bookmarks "id" SQL Injection Vulnerability

6.	Avaya CMS Solaris "snoop" Multiple Vulnerabilities

7.	Subdreamer Light Global Variables SQL Injection Vulnerability

8.	Ubuntu update for postfix

9.	Avaya CMS Solaris namefs Kernel Module Privilege Escalation

10.	WS_FTP Home / Professional Format String Vulnerability