PT-2018-3116 · Apache+5 · Apache Httpd+6

Published 2018-03-21 · Updated 2021-06-06 · CVE-2017-15715

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.4.0 through 2.4.29

Description The issue arises from the expression specified in FilesMatch being able to match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename. The vulnerability exists due to insufficient input validation, which may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Apache httpd versions 2.4.0 through 2.4.29, consider updating to a version where this issue is fixed, as the current version may allow malicious filenames to bypass external blocking by matching the trailing portion of the filename. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1519

BDU:2019-04106

CESA-2020_3958

CVE-2017-15715

DSA-4164-1

MGASA-2018-0460

RHSA-2018:3558

RHSA-2019:0367

RHSA-2020:3958

RHSA-2020_3958

SUSE-SU-2018:0879-1

SUSE-SU-2018:0901-1

SUSE-SU-2018:1161-1

SUSE-SU-2018:1161-2

USN-3627-1

USN-3627-2

Affected Products

Alt Linux

Apache Http Server

Apache Httpd

Centos

Red Hat

Suse

Ubuntu

References · 123

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1312 · Security Note
• https://ubuntu.com/security/CVE-2018-1303 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1303 · Security Note
• https://ubuntu.com/security/CVE-2018-1283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15715 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-15715 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0879-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03569 · Security Note
• https://ubuntu.com/security/CVE-2018-1301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15715 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1301 · Security Note
• https://advisories.mageia.org/MGASA-2018-0460.html · Security Note
• https://bdu.fstec.ru/vul/2018-01420 · Security Note
• https://bdu.fstec.ru/vul/2019-03652 · Security Note
• https://security-tracker.debian.org/tracker/source-package/apache2 · Vendor Advisory