PT-2016-3152 · Apache+5 · Apache Http Server+5

Published 2016-12-20 · Updated 2021-06-06 · CVE-2016-0736

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.23 Apache HTTP Server versions prior to 2.4.25

Description The issue is related to errors in the encryption algorithm of the mod session crypto module in Apache HTTP Server. The module encrypts its data/cookie using configured ciphers with either CBC or ECB modes of operation, with AES256-CBC as the default. This results in a lack of selectable or built-in authenticated encryption, making it vulnerable to padding oracle attacks, particularly with CBC.

Recommendations For Apache HTTP Server versions 2.4.0 through 2.4.23, update to version 2.4.25 or later to resolve the issue. For Apache HTTP Server versions prior to 2.4.25, update to version 2.4.25 or later to resolve the issue. As a temporary workaround, consider disabling the mod session crypto module until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2017-1655

BDU:2017-01806

CESA-2017_0906

CVE-2016-0736

DSA-3796-1

MGASA-2018-0007

RHSA-2017:0906

RHSA-2017:1161

RHSA-2017:1413

RHSA-2017:1414

RHSA-2017_0906

SUSE-SU-2017:0797-1

SUSE-SU-2017:0801-1

SUSE-SU-2017_0797-1

SUSE-SU-2017_0801-1

USN-3279-1

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 96

• 🔥 https://exploit-db.com/exploits/40961 · Exploit
• https://access.redhat.com/errata/RHSA-2017:0906 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-0736 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0736 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1655 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0736 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4975 · Security Note
• https://debian.org/security/2017/dsa-3913 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-0736 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01804 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-0736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1161 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3279-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0801-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-1415.html · Vendor Advisory