PT-2016-6205 · Apache+1 · Apache Http Server+1

Erki Aring · Published 2016-07-05 · Updated 2024-06-15 · CVE-2016-4979

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.18 through 2.4.20

Description The issue allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation, when mod http2 and mod ssl are enabled. This is due to the improper recognition of the SSLVerifyClient require directive for HTTP/2 request authorization. The problem affects configurations that enable support for HTTP/2, where SSL client certificate validation was not enforced if configured, allowing clients unauthorized access to protected resources over HTTP/2.

Recommendations For versions 2.4.18 through 2.4.20, consider disabling the mod http2 module until a patch is available to enforce SSL client certificate validation for HTTP/2 requests. Restrict access to protected resources over HTTP/2 to minimize the risk of exploitation. Avoid relying solely on the SSLVerifyClient require directive for access control in HTTP/2 configurations.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1877

CVE-2016-4979

OPENSUSE-SU-2024:10268-1

RHSA-2016:1420

Affected Products

Alt Linux

Apache Http Server

References · 87

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4979 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-4979 · Vendor Advisory
• https://security.gentoo.org/glsa/201610-02 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1420 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1877 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4979 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01707 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-4979 · Security Note
• http://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4979 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8612 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1546 · Security Note
• https://github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2 · Note
• https://suse.com/security/cve/CVE-2014-0117 · Note