PT-2016-3336 · Apache+2 · Apache Http Server+2

Publicado 2016-11-18 · Atualizado 2021-06-06 · CVE-2017-7659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.24 through 2.4.25

Description The issue is related to the mod http2 module in Apache HTTP Server, which incorrectly handles maliciously constructed HTTP/2 requests. This can cause the server process to crash due to a NULL pointer dereference, potentially leading to a denial of service. The issue can be exploited by a remote attacker.

Recommendations For versions 2.4.24 and 2.4.25, consider disabling the mod http2 module as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2017-1783

BDU:2021-01393

CVE-2017-7659

DSA-3896-1

RHSA-2017:2483

SUSE-SU-2018:0261-1

SUSE-SU-2018_0261-1

Produtos afetados

Alt Linux

Apache Http Server

Suse

Referências · 63

• 🔥 https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679 · Exploit
• https://bdu.fstec.ru/vul/2017-02153 · Nota de Segurança
• https://bugzilla.suse.com/1045160 · Nota
• https://bdu.fstec.ru/vul/2017-02150 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7659 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2483 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20180601-0002 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7668 · Nota de Segurança
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2017-7659 · Nota
• https://bugzilla.suse.com/1048575 · Nota
• https://bugzilla.suse.com/1057406 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3169 · Nota de Segurança
• https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E · Nota