← back
CVE-2005-2700

CVE-2005-2700

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 31%
exploitation probability
31%top 2% of all CVEs
observed exploitation
nono source reports it
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Affected products
n/a · n/a
References
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.htmlhttp://marc.info/?l=apache-modssl&m=112569517603897&w=2http://marc.info/?l=bugtraq&m=112604765028607&w=2http://marc.info/?l=bugtraq&m=112870296926652&w=2http://people.apache.org/~jorton/CAN-2005-2700.diffhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195http://secunia.com/advisories/16700http://secunia.com/advisories/16705http://secunia.com/advisories/16714http://secunia.com/advisories/16743http://secunia.com/advisories/16746http://secunia.com/advisories/16748