HTTP: Request Injection

This signature detects attempts to inject a potentially malicious HTTP request into a legitimate HTTP session. This can indicate a man-in-the-middle attack is taking place. Even if this is not part of the RFC more and more web application use a header that copy the request. Monitor the usage of such header as this could be seen as a false positive from this signature.

Extended Description

Multiple vendors' TLS protocol implementations are prone to a security vulnerability related to the session-renegotiation process. Successful exploits of this issue may allow attackers to perform limited man-in-the-middle attacks against vulnerable applications. Note that this issue does not allow attackers to decrypt encrypted data.

Affected Products

Cisco wireless_lan_control,Sun java_system_web_server,Opera_software opera_web_browser

References

BugTraq: 36935

CVE: CVE-2009-3555

Short Name

HTTP:REQERR:REQ-INJECTION

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: Request Injection

Extended Description

Affected Products

References

Found a potential security threat?