CVE-2005-2700

security flaw

Published Sep 6, 2005 CVSS 2.0 · 10.0 Critical EPSS 30.6% KEV · Not listed
Description
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2005-2701 ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Ubuntu USN Ubuntu USN USN-177-1 Apache 2 vulnerabilities
References
Link Providers
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html cve-icon cve-icon
http://marc.info/?l=apache-modssl&m=112569517603897&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=112604765028607&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=112870296926652&w=2 cve-icon cve-icon
http://people.apache.org/~jorton/CAN-2005-2700.diff cve-icon cve-icon
http://secunia.com/advisories/16700 cve-icon cve-icon
http://secunia.com/advisories/16705 cve-icon cve-icon
http://secunia.com/advisories/16714 cve-icon cve-icon
http://secunia.com/advisories/16743 cve-icon cve-icon
http://secunia.com/advisories/16746 cve-icon cve-icon
http://secunia.com/advisories/16748 cve-icon cve-icon
http://secunia.com/advisories/16753 cve-icon cve-icon
http://secunia.com/advisories/16754 cve-icon cve-icon
http://secunia.com/advisories/16769 cve-icon cve-icon
http://secunia.com/advisories/16771 cve-icon cve-icon
http://secunia.com/advisories/16789 cve-icon cve-icon
http://secunia.com/advisories/16864 cve-icon cve-icon
http://secunia.com/advisories/16956 cve-icon cve-icon
http://secunia.com/advisories/17088 cve-icon cve-icon
http://secunia.com/advisories/17288 cve-icon cve-icon
http://secunia.com/advisories/17311 cve-icon cve-icon
http://secunia.com/advisories/17813 cve-icon cve-icon
http://secunia.com/advisories/19072 cve-icon cve-icon
http://secunia.com/advisories/19073 cve-icon cve-icon
http://secunia.com/advisories/21848 cve-icon cve-icon
http://secunia.com/advisories/22523 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 cve-icon cve-icon
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm cve-icon cve-icon
http://www.debian.org/security/2005/dsa-805 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-807 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200509-12.xml cve-icon cve-icon
http://www.kb.cert.org/vuls/id/744929 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2005:161 cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2005_51_apache2.html cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2005_52_apache2.html cve-icon cve-icon
http://www.osvdb.org/19188 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-608.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-773.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2005-816.html cve-icon cve-icon
http://www.securityfocus.com/bid/14721 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-177-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2005/1625 cve-icon cve-icon
http://www.vupen.com/english/advisories/2005/2659 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/0789 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4207 cve-icon cve-icon
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 cve-icon cve-icon
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195 cve-icon cve-icon
https://lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb%40%3Cdev.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5b1e7d66c5adf286f14f6cc0f857b6fca107444f68aed9e70eedab47%40%3Cdev.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E cve-icon cve-icon
https://lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2005-2700 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10416 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2005-2700 cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 10:45 PM
Reserved
Aug 26, 2005, 12:00 AM
Status
Modified
Published
Sep 6, 2005, 11:03 PM
Modified
Jun 16, 2026, 10:15 PM
Severity
Important
Public date
Aug 30, 2005, 12:00 AM