An update for httpd is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es) :

* It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788)

* It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167)

* A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169)

* A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Secure Global Desktop installed on the remote host is 5.3 and is missing a security patch from the October 2017 Critical Patch Update (CPU). It is, therefore, affected by an Apache HTTP server remote authentication bypass vulnerability in the web services component. The  Apache HTTP Server contains a flaw that is triggered when  third-party modules use the ap_get_basic_auth_pw() function outside of the authentication phase. This allows a remote attacker to bypass authentication requirements.

According to its banner, the version of Apache running on the remote host is 2.2.x prior to 2.2.33-dev or 2.4.x prior to 2.4.26. It is, therefore, affected by the following vulnerabilities :

  - An authentication bypass vulnerability exists due to     third-party modules using the ap_get_basic_auth_pw()     function outside of the authentication phase. An     unauthenticated, remote attacker can exploit this to     bypass authentication requirements. (CVE-2017-3167)

  - A NULL pointer dereference flaw exists due to     third-party module calls to the mod_ssl     ap_hook_process_connection() function during an HTTP     request to an HTTPS port. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2017-3169)

  - A NULL pointer dereference flaw exists in mod_http2 that     is triggered when handling a specially crafted HTTP/2     request. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition. Note that     this vulnerability does not affect 2.2.x.
    (CVE-2017-7659)

  - An out-of-bounds read error exists in the     ap_find_token() function due to improper handling of     header sequences. An unauthenticated, remote attacker     can exploit this, via a specially crafted header     sequence, to cause a denial of service condition.
    (CVE-2017-7668)

  - An out-of-bounds read error exists in mod_mime due to     improper handling of Content-Type response headers. An     unauthenticated, remote attacker can exploit this, via a     specially crafted Content-Type response header, to cause     a denial of service condition or the disclosure of     sensitive information. (CVE-2017-7679)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in the Apache HTTPD server.

  - CVE-2017-3167     Emmanuel Dreyfus reported that the use of     ap_get_basic_auth_pw() by third-party modules outside of     the authentication phase may lead to authentication     requirements being bypassed.

  - CVE-2017-3169     Vasileios Panopoulos of AdNovum Informatik AG discovered     that mod_ssl may dereference a NULL pointer when     third-party modules call ap_hook_process_connection()     during an HTTP request to an HTTPS port leading to a     denial of service.

  - CVE-2017-7659     Robert Swiecki reported that a specially crafted HTTP/2     request could cause mod_http2 to dereference a NULL     pointer and crash the server process.

  - CVE-2017-7668     Javier Jimenez reported that the HTTP strict parsing     contains a flaw leading to a buffer overread in     ap_find_token(). A remote attacker can take advantage of     this flaw by carefully crafting a sequence of request     headers to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.

  - CVE-2017-7679     ChenQin and Hanno Boeck reported that mod_mime can read     one byte past the end of a buffer when sending a     malicious Content-Type response header.

Several vulnerabilities have been found in the Apache HTTPD server.

CVE-2017-3167

Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVE-2017-3169

Vasileios Panopoulos of AdNovum Informatik AG discovered that mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port leading to a denial of service.

CVE-2017-7668

Javier Jimenez reported that the HTTP strict parsing contains a flaw leading to a buffer overread in ap_find_token(). A remote attacker can take advantage of this flaw by carefully crafting a sequence of request headers to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

CVE-2017-7679

ChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.

For Debian 7 'Wheezy', these problems have been fixed in version 2.2.22-13+deb7u9.

We recommend that you upgrade your apache2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169)

It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167)

A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788)

ID	Name	Product	Family	Published	Updated	Severity
119222	Virtuozzo 6 : httpd / httpd-devel / httpd-manual / httpd-tools / etc (VZLSA-2017-2478)	Nessus	Virtuozzo Local Security Checks	11/27/2018	7/18/2024	critical
103980	Oracle Secure Global Desktop Web Services Component Remote Authentication Bypass (October 2017 CPU)	Nessus	Misc.	10/19/2017	10/25/2021	critical
100995	Apache 2.2.x < 2.2.33-dev / 2.4.x < 2.4.26 Multiple Vulnerabilities	Nessus	Web Servers	6/22/2017	12/15/2025	critical
101013	Debian DSA-3896-1 : apache2 - security update	Nessus	Debian Local Security Checks	6/23/2017	12/15/2025	critical
101175	Debian DLA-1009-1 : apache2 security update	Nessus	Debian Local Security Checks	7/3/2017	12/12/2025	critical
103226	Amazon Linux AMI : httpd (ALAS-2017-892)	Nessus	Amazon Linux Local Security Checks	9/15/2017	11/21/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical