PT-2018-3638 · Apache+2 · Apache Http Server+2

Daniel Caminada · Publicado 2018-03-09 · Atualizado 2021-06-06 · CVE-2018-8011

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.33

Description The issue is related to the mod md challenge handler, which can dereference a NULL pointer when specially crafted HTTP requests are made, causing the child process to segfault. This can be used to cause a denial of service (DoS) to the server.

Recommendations For Apache HTTP Server version 2.4.33, update to version 2.4.34 to resolve the issue. As a temporary workaround, consider restricting access to the mod md module to minimize the risk of exploitation.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-2068

BDU:2021-01497

CVE-2018-8011

OPENSUSE-SU-2018_2433-1

SUSE-SU-2018:2424-1

Produtos afetados

Alt Linux

Apache Http Server

Suse

Referências · 46

• https://bdu.fstec.ru/vul/2021-01497 · Nota de Segurança
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2018-8011.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8011 · Aviso do Fabricante
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs. · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20182424-1 · Nota
• https://bugzilla.suse.com/1101688 · Nota
• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs. · Nota
• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E · Nota
• https://security.alpinelinux.org/vuln/CVE-2018-8011 · Nota
• https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E · Nota