PT-2016-3172 · Apache+5 · Apache Http Server+5

Published 2016-12-05 · Updated 2025-11-04 · CVE-2017-3167

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.2.x through 2.2.32 Apache httpd versions 2.4.x through 2.4.25

Description The issue is related to the use of the ap get basic auth pw() function by third-party modules outside of the authentication phase, which may lead to authentication requirements being bypassed. This is due to shortcomings in the authentication procedure. An attacker could exploit this to bypass authentication requirements using external third-party modules.

Recommendations For Apache httpd versions 2.2.x through 2.2.32, update to version 2.2.33 or later. For Apache httpd versions 2.4.x through 2.4.25, update to version 2.4.26 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2017-1783

BDU:2017-02153

CESA-2017_2478

CESA-2017_2479

CVE-2017-3167

DLA-1009-1

DSA-3896-1

MGASA-2018-0007

RHSA-2017:2478

RHSA-2017:2479

RHSA-2017:2483

RHSA-2017:3193

RHSA-2017:3194

RHSA-2017:3195

RHSA-2017:3476

RHSA-2017:3477

RHSA-2017_2478

RHSA-2017_2479

SUSE-SU-2017:1714-1

SUSE-SU-2017:2449-1

SUSE-SU-2017:2756-1

SUSE-SU-2017:2907-1

USN-3340-1

USN-3373-1

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 137

• 🔥 https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3169 · Security Note
• https://ubuntu.com/security/notices/USN-3373-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-32 · Vendor Advisory
• https://debian.org/security/2017/dsa-3913 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-3167 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3896-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2479 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-3167 · Security Note
• https://bdu.fstec.ru/vul/2021-01393 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3167 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2756-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3169 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2478 · Vendor Advisory