CVE-2013-5704 Security feature bypass in n/a

Medium 5.0 Published 15 Apr 2014 Updated 6 Aug 2024

Remote attackers can bypass RequestHeader unset directives in Apache mod_headers by using chunked transfer coding trailers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-5704?

CVE-2013-5704 is a medium-severity vulnerability in Apache Http Server, published on 15 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Which versions are affected by CVE-2013-5704?

It affects 15 products.

Linux distribution packages (24)

`httpd` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-45.el6`
`httpd-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-45.el6`
`httpd-devel` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-45.el6`
`httpd-manual` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-45.el6`
`httpd-tools` Red Hat:enterprise_linux:6::client	All versions	`0:2.2.15-45.el6`
`mod_ssl` Red Hat:enterprise_linux:6::client	All versions	`1:2.2.15-45.el6`
`httpd` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-45.el6`
`httpd-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-45.el6`
`httpd-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-45.el6`
`httpd-manual` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-45.el6`
`httpd-tools` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.2.15-45.el6`
`mod_ssl` Red Hat:enterprise_linux:6::computenode	All versions	`1:2.2.15-45.el6`
`httpd` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-45.el6`
`httpd-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-45.el6`
`httpd-devel` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-45.el6`
`httpd-manual` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-45.el6`
`httpd-tools` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.15-45.el6`
`mod_ssl` Red Hat:enterprise_linux:6::server	All versions	`1:2.2.15-45.el6`
`httpd` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-45.el6`
`httpd-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-45.el6`
`httpd-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-45.el6`
`httpd-manual` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-45.el6`
`httpd-tools` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.15-45.el6`
`mod_ssl` Red Hat:enterprise_linux:6::workstation	All versions	`1:2.2.15-45.el6`

Products include Apache Http Server, Apple Mac Os X, Apple Mac Os X Server, Canonical Ubuntu Linux, Oracle Enterprise Manager Ops Center, Oracle Http Server and 9 more.

How do I fix CVE-2013-5704?

Apply the vendor's patch.

Is CVE-2013-5704 being exploited?

There is no known exploitation of CVE-2013-5704 in the wild and no public exploit code.

All Apache Http Server vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-5704, GHSA-gwg2-5774-jpjm, RHSA-2015:1249, UBUNTU-CVE-2013-5704.