PT-2019-3930 · Apache+5 · Apache Http Server+5

Publicado 2019-04-01 · Atualizado 2021-06-06 · CVE-2019-0217

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.38 and prior

Description A race condition in the mod auth digest component of the Apache HTTP Server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. This issue is caused by synchronization errors when using a shared resource. The exploitation of this issue may allow a remote attacker to authenticate using a different username.

Recommendations For Apache HTTP Server versions 2.4.38 and prior, consider disabling the mod auth digest module until a patch is available to prevent potential exploitation. Restrict access to sensitive areas of the server to minimize the risk of unauthorized access.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2019-1580

BDU:2019-04408

CESA-2019_2343

CESA-2019_3436

CVE-2019-0217

DLA-1748-1

DSA-4422-1

OPENSUSE-SU-2019:1209-1

OPENSUSE-SU-2019_1190-1

OPENSUSE-SU-2019_1209-1

OPENSUSE-SU-2019_1258-1

RHSA-2019:2343

RHSA-2019:3436

RHSA-2019:3932

RHSA-2019:3933

RHSA-2019:4126

RHSA-2019_2343

RHSA-2019_3436

SUSE-SU-2019:0873-1

SUSE-SU-2019:0878-1

SUSE-SU-2019:0888-1

SUSE-SU-2019:0888-2

SUSE-SU-2019:0889-1

USN-3937-1

USN-3937-2

Produtos afetados

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

Referências · 99

• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0217 · Nota
• https://suse.com/security/cve/CVE-2018-17199 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20190888-1 · Nota
• https://suse.com/security/cve/CVE-2019-0197 · Nota
• https://osv.dev/vulnerability/DLA-1748-1 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2019-0217 · Nota
• https://bugzilla.suse.com/1122839 · Nota
• https://ubuntu.com/security/CVE-2018-17199 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:0888-2 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-0217 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1695020 · Nota
• https://bugzilla.suse.com/1131245 · Nota
• https://usn.ubuntu.com/3937-2 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-0217 · Nota de Segurança
• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E · Nota