CVE-2007-4164: CRLF Injection
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4164?
CVE-2007-4164 is considered a high severity vulnerability due to its potential for CRLF injection attacks that can lead to unauthorized data access.
How do I fix CVE-2007-4164?
To fix CVE-2007-4164, update to Sun Java System Web Server version 6.1-sp8 or 7.0 or later which contain the necessary patches.
What systems are affected by CVE-2007-4164?
CVE-2007-4164 affects Sun Java System Web Server versions 6.1 and 7.0 prior to the updates released on 20070802.
What is CRLF injection as mentioned in CVE-2007-4164?
CRLF injection is a vulnerability that allows attackers to inject carriage return and line feed characters into HTTP headers, potentially leading to HTTP response splitting attacks.
Can CVE-2007-4164 be exploited remotely?
Yes, CVE-2007-4164 can be exploited remotely, enabling attackers to manipulate web server responses.