PT-2017-3337 · Apache+5 · Apache Http Server+5

Publicado

2017-07-11

·

Atualizado

2021-06-06

·

CVE-2017-9788

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.2.x through 2.2.33 Apache httpd versions 2.4.x through 2.4.26
Description The issue is related to the mod auth digest module in Apache HTTP Server, where the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not properly initialized or reset. This could lead to the leakage of potentially confidential information and cause a denial of service due to a segfault. The problem occurs when an initial key with no '=' assignment is provided, reflecting the stale value of uninitialized pool memory used by the prior request.
Recommendations For Apache httpd versions 2.2.x through 2.2.33, update to version 2.2.34 or later. For Apache httpd versions 2.4.x through 2.4.26, update to version 2.4.27 or later.

Correção

DoS

RCE

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

ALT-PU-2017-1930
BDU:2018-00102
CESA-2017_2478
CESA-2017_2479
CVE-2017-9788
DLA-1028-1
DSA-3913-1
MGASA-2017-0298
MGASA-2018-0007
RHSA-2017:2478
RHSA-2017:2479
RHSA-2017:2483
RHSA-2017:2709
RHSA-2017:2710
RHSA-2017:3113
RHSA-2017:3193
RHSA-2017:3194
RHSA-2017:3195
RHSA-2017:3240
RHSA-2017_2478
RHSA-2017_2479
SUSE-SU-2017:1961-1
SUSE-SU-2017:1997-1
SUSE-SU-2017:2449-1
SUSE-SU-2017:2756-1
SUSE-SU-2017_1961-1
SUSE-SU-2017_1997-1
USN-3370-1
USN-3370-2

Produtos afetados

Alt Linux
Apache Http Server
Centos
Red Hat
Suse
Ubuntu