PT-2016-3151 · Apache+5 · Apache Http Server+5

Maksim Malyutin · Publicado 2016-12-20 · Atualizado 2021-06-06 · CVE-2016-2161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.23

Description The issue is caused by insufficient input validation in the mod auth digest module of the Apache HTTP Server. This can be exploited by a remote attacker to cause the server to crash. Each instance of the server continues to crash even when subsequent valid requests are made.

Recommendations For Apache HTTP Server versions 2.4.0 through 2.4.23, consider disabling the mod auth digest module as a temporary workaround until a patch is available. Restrict access to the mod auth digest module to minimize the risk of exploitation. Update to a version that includes the fix for this issue to fully resolve it.

Correção

RCE

Enumeração de Fraquezas

CWE-823

CWE-20

Identificadores relacionados

ALT-PU-2017-1655

BDU:2017-01805

CESA-2017_0906

CVE-2016-2161

DSA-3796-1

MGASA-2018-0007

RHSA-2017:0906

RHSA-2017:1161

RHSA-2017:1413

RHSA-2017:1414

RHSA-2017_0906

SUSE-SU-2017:0729-1

SUSE-SU-2017:0797-1

SUSE-SU-2017:0801-1

SUSE-SU-2017_0729-1

USN-3279-1

Produtos afetados

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

Referências · 97

• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-2161 · Aviso do Fabricante
• https://bugzilla.suse.com/1016715 · Nota
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2017:0906 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-2161 · Aviso do Fabricante
• https://usn.ubuntu.com/usn/usn-3425-1 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2161 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2161.html · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• http://securitytracker.com/id/1037508 · Nota
• https://errata.altlinux.org/ALT-PU-2017-1655 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4975 · Nota de Segurança
• https://debian.org/security/2017/dsa-3913 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E · Nota
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us · Nota