PT-2018-3115 · Apache+5 · Apache Httpd+6
Alex Nichols
+1
·
Published
2018-03-21
·
Updated
2021-06-06
·
CVE-2017-15710
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Apache httpd versions 2.0.23 through 2.0.65
Apache httpd versions 2.2.0 through 2.2.34
Apache httpd versions 2.4.0 through 2.4.29
Description
The issue is related to the mod authnz ldap component in Apache httpd, specifically when configured with AuthLDAPCharsetConfig. It uses the Accept-Language header value to determine the correct charset encoding for user credential verification. If the header value is not found in the charset conversion table, it is truncated to a two-character value. A header value with less than two characters can cause an out-of-bounds write of a NUL byte to a memory location, potentially leading to a Denial of Service attack, although this is unlikely. In most cases, the memory is already reserved for future use, and the issue has no effect.
Recommendations
For Apache httpd versions 2.0.23 through 2.0.65, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available.
For Apache httpd versions 2.2.0 through 2.2.34, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available.
For Apache httpd versions 2.4.0 through 2.4.29, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available.
As a temporary workaround, consider restricting access to the
Accept-Language header to minimize the risk of exploitation.Fix
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Http Server
Apache Httpd
Centos
Red Hat
Suse
Ubuntu