PT-2016-3336 · Apache+2 · Apache Http Server+2

Published 2016-11-18 · Updated 2021-06-06 · CVE-2017-7659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.24 through 2.4.25

Description The issue is related to the mod http2 module in Apache HTTP Server, which incorrectly handles maliciously constructed HTTP/2 requests. This can cause the server process to crash due to a NULL pointer dereference, potentially leading to a denial of service. The issue can be exploited by a remote attacker.

Recommendations For versions 2.4.24 and 2.4.25, consider disabling the mod http2 module as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-1783

BDU:2021-01393

CVE-2017-7659

DSA-3896-1

RHSA-2017:2483

SUSE-SU-2018:0261-1

SUSE-SU-2018_0261-1

Affected Products

Alt Linux

Apache Http Server

Suse

References · 63

• 🔥 https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679 · Exploit
• https://bdu.fstec.ru/vul/2017-02153 · Security Note
• https://bdu.fstec.ru/vul/2017-02150 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7659 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2483 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7668 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3169 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3167 · Security Note
• https://bdu.fstec.ru/vul/2017-02149 · Security Note
• https://osv.dev/vulnerability/DSA-3896-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7659 · Security Note
• https://bdu.fstec.ru/vul/2021-01393 · Security Note
• https://security.gentoo.org/glsa/201710-32 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7659 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3896-1 · Vendor Advisory