PT-2017-3746 · Apache+2 · Httpd+2

Kawahara Masashi + 1 · Published 2017-10-19 · Updated 2023-02-12 · CVE-2017-12171

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: httpd version 2.2.15-60

Description: A regression was found in httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. This issue is related to the use of memory after it has been freed when processing comments in the Allow and Deny lines of the Limit directive in the .htaccess configuration file. Exploitation of this issue may allow a remote attacker to cause a crash of the httpd child process or gain access to restricted HTTP resources.

Recommendations: For httpd version 2.2.15-60, consider updating to a newer version that includes a fix for this issue, as the current version may allow unintended access to restricted HTTP resources due to incorrect parsing of comments in configuration lines.

Fix

Improper Access Control

Use After Free

RCE

Weakness Enumeration

CWE-284

CWE-416

CWE-20

Related Identifiers

BDU:2019-00234

CESA-2017_2972

CVE-2017-12171

RHSA-2017:2972

RHSA-2017_2972

Affected Products

Centos

Red Hat

Httpd

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-12171 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12171 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12171 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00234 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2972 · Vendor Advisory
• http://securityfocus.com/bid/101516 · Note
• https://rapid7.com/db/vulnerabilities/centos_linux-cve-2017-12171 · Note
• https://securityfocus.com/bid/101516/discuss · Note
• https://access.redhat.com/security/cve/cve-2017-12171 · Note
• http://securitytracker.com/id/1039633 · Note