CVE-2015-3185MEDIUM
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
References
http://httpd.apache.org/security/vulnerabilities_24.html
http://www.apache.org/dist/httpd/CHANGES_2.4
https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
https://support.apple.com/kb/HT205031
http://www.ubuntu.com/usn/USN-2686-1
https://support.apple.com/HT205217
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
https://support.apple.com/HT205219
http://www.securityfocus.com/bid/75965
http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html
http://www.debian.org/security/2015/dsa-3325
http://rhn.redhat.com/errata/RHSA-2015-1667.html
http://www.securitytracker.com/id/1032967
https://access.redhat.com/errata/RHSA-2017:2710
https://access.redhat.com/errata/RHSA-2017:2709
https://access.redhat.com/errata/RHSA-2017:2708
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://rhn.redhat.com/errata/RHSA-2015-1666.html
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://github.com/apache/httpd/commit/db81019ab88734ed35fa70294a0cfa7a19743f73
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Configuration 2
OR
cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*
Configuration 3
OR
cpe:2.3:o:apple:mac_os_x_server:5.0.3:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 124922 | EulerOS Virtualization 3.0.1.0 : httpd (EulerOS-SA-2019-1419) | Nessus | Huawei Local Security Checks | critical |
| 98908 | Apache 2.4.x < 2.4.16 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | high |
| 103241 | RHEL 6 : JBoss Core Services (RHSA-2017:2710) | Nessus | Red Hat Local Security Checks | critical |
| 103240 | RHEL 7 : JBoss Core Services (RHSA-2017:2709) | Nessus | Red Hat Local Security Checks | critical |
| 86703 | SUSE SLES12 Security Update : apache2 (SUSE-SU-2015:1851-1) (Logjam) | Nessus | SuSE Local Security Checks | low |
| 8981 | Mac OS X < 10.10.5 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | high |
| 8970 | Apache HTTP Server 2.4.x < 2.4.16 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | medium |
| 86285 | openSUSE Security Update : apache2 (openSUSE-2015-635) (Logjam) | Nessus | SuSE Local Security Checks | low |
| 86245 | Apple Xcode < 7.0 (Mac OS X) (POODLE) | Nessus | MacOS X Local Security Checks | high |
| 86066 | Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 85636 | CentOS 7 : httpd (CESA-2015:1667) | Nessus | CentOS Local Security Checks | medium |
| 85628 | Tenable SecurityCenter Multiple Apache Vulnerabilities (TNS-2015-11) | Nessus | Web Servers | medium |
| 85621 | Scientific Linux Security Update : httpd on SL7.x x86_64 (20150824) | Nessus | Scientific Linux Local Security Checks | medium |
| 85617 | RHEL 7 : httpd (RHSA-2015:1667) | Nessus | Red Hat Local Security Checks | medium |
| 85613 | Oracle Linux 7 : httpd (ELSA-2015-1667) | Nessus | Oracle Linux Local Security Checks | medium |
| 85452 | Amazon Linux AMI : httpd24 (ALAS-2015-579) | Nessus | Amazon Linux Local Security Checks | medium |
| 85409 | Mac OS X Multiple Vulnerabilities (Security Update 2015-006) | Nessus | MacOS X Local Security Checks | high |
| 85408 | Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | high |
| 85164 | Debian DSA-3325-1 : apache2 - security update | Nessus | Debian Local Security Checks | medium |
| 85092 | Fedora 21 : httpd-2.4.16-1.fc21 (2015-11792) | Nessus | Fedora Local Security Checks | medium |
| 85042 | Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : apache2 vulnerabilities (USN-2686-1) | Nessus | Ubuntu Local Security Checks | medium |
| 84959 | Apache 2.4.x < 2.4.16 Multiple Vulnerabilities | Nessus | Web Servers | medium |
| 84906 | Fedora 22 : httpd-2.4.16-1.fc22 (2015-11689) | Nessus | Fedora Local Security Checks | medium |
| 84829 | Slackware 14.0 / 14.1 / current : httpd (SSA:2015-198-01) | Nessus | Slackware Local Security Checks | medium |
| 84781 | FreeBSD : apache24 -- multiple vulnerabilities (a12494c1-2af4-11e5-86ff-14dae9d210b8) | Nessus | FreeBSD Local Security Checks | medium |