PT-2016-3151 · Apache+5 · Apache Http Server+5

Maksim Malyutin · Published 2016-12-20 · Updated 2021-06-06 · CVE-2016-2161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.23

Description The issue is caused by insufficient input validation in the mod auth digest module of the Apache HTTP Server. This can be exploited by a remote attacker to cause the server to crash. Each instance of the server continues to crash even when subsequent valid requests are made.

Recommendations For Apache HTTP Server versions 2.4.0 through 2.4.23, consider disabling the mod auth digest module as a temporary workaround until a patch is available. Restrict access to the mod auth digest module to minimize the risk of exploitation. Update to a version that includes the fix for this issue to fully resolve it.

Fix

RCE

Weakness Enumeration

CWE-823

CWE-20

Related Identifiers

ALT-PU-2017-1655

BDU:2017-01805

CESA-2017_0906

CVE-2016-2161

DSA-3796-1

MGASA-2018-0007

RHSA-2017:0906

RHSA-2017:1161

RHSA-2017:1413

RHSA-2017:1414

RHSA-2017_0906

SUSE-SU-2017:0729-1

SUSE-SU-2017:0797-1

SUSE-SU-2017:0801-1

SUSE-SU-2017_0729-1

USN-3279-1

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 97

• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-2161 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0906 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2161 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2161 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1655 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4975 · Security Note
• https://debian.org/security/2017/dsa-3913 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01804 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2161 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1161 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3279-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2161 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0801-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-1415.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01806 · Security Note