The following security-related issues were fixed :

Padding oracle vulnerability in Apache mod_session_crypto (CVE-2016-0736)

DoS vulnerability in mod_auth_digest (CVE-2016-2161)

Apache HTTP request parsing whitespace defects (CVE-2016-8743)

This update for apache2 fixes the following security issues: Security issues fixed :

  - CVE-2016-0736: Protect mod_session_crypto data with a     MAC to prevent padding oracle attacks (bsc#1016712).

  - CVE-2016-2161: Malicious input to mod_auth_digest could     have caused the server to crash, resulting in DoS     (bsc#1016714).

  - CVE-2016-8743: Added new directive 'HttpProtocolOptions     Strict' to avoid proxy chain misinterpretation     (bsc#1016715). Bugfixes :

  - Add missing copy of hcuri and hcexpr from the worker to     the health check worker (bsc#1019380).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the mod_session_crypto module of     httpd did not use any mechanisms to verify integrity of     the encrypted session data stored in the user's     browser. A remote attacker could use this flaw to     decrypt and modify session data using a padding oracle     attack. (CVE-2016-0736)

  - It was discovered that the mod_auth_digest module of     httpd did not properly check for memory allocation     failures. A remote attacker could use this flaw to     cause httpd child processes to repeatedly crash if the     server used HTTP digest authentication. (CVE-2016-2161)

  - It was discovered that the HTTP parser in httpd     incorrectly allowed certain characters not permitted by     the HTTP protocol specification to appear unencoded in     HTTP request headers. If httpd was used in conjunction     with a proxy or backend server that interpreted those     characters differently, a remote attacker could     possibly use this flaw to inject data into HTTP     responses, resulting in proxy cache poisoning.
    (CVE-2016-8743)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1637:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2016-0736
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1546     The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled,     does not limit the number of simultaneous stream workers for a single     HTTP/2 connection, which allows remote attackers to cause a denial of     service (stream-processing outage) via modified flow-control windows.
    CVE-2016-2161
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8740     The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23,     when the Protocols configuration includes h2 or h2c, does not restrict     request-header length, which allows remote attackers to cause a denial     of service (memory consumption) via crafted CONTINUATION frames in an     HTTP/2 request.
    CVE-2016-8743
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.25. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_session_crypto module due to     encryption for data and cookies using the configured     ciphers with possibly either CBC or ECB modes of     operation (AES256-CBC by default). An unauthenticated,     remote attacker can exploit this, via a padding oracle     attack, to decrypt information without knowledge of the     encryption key, resulting in the disclosure of     potentially sensitive information. (CVE-2016-0736)

  - A denial of service vulnerability exists in the     mod_auth_digest module during client entry allocation.
    An unauthenticated, remote attacker can exploit this,     via specially crafted input, to exhaust shared memory     resources, resulting in a server crash. (CVE-2016-2161)

  - The Apache HTTP Server is affected by a     man-in-the-middle vulnerability known as 'httpoxy' due     to a failure to properly resolve namespace conflicts in     accordance with RFC 3875 section 4.1.18. The HTTP_PROXY     environment variable is set based on untrusted user data     in the 'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5387)

  - A denial of service vulnerability exists in the     mod_http2 module due to improper handling of the     LimitRequestFields directive. An unauthenticated, remote     attacker can exploit this, via specially crafted     CONTINUATION frames in an HTTP/2 request, to inject     unlimited request headers into the server, resulting in     the exhaustion of memory resources. (CVE-2016-8740)

  - A flaw exists due to improper handling of whitespace     patterns in user-agent headers. An unauthenticated,     remote attacker can exploit this, via a specially     crafted user-agent header, to cause the program to     incorrectly process sequences of requests, resulting in     interpreting responses incorrectly, polluting the cache,     or disclosing the content from one request to a second     downstream user-agent. (CVE-2016-8743)

  - A CRLF injection allowing HTTP response splitting attacks for     sites which use mod_userdir (CVE-2016-4975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
96631	Amazon Linux AMI : httpd24 (ALAS-2017-785)	Nessus	Amazon Linux Local Security Checks	1/20/2017	1/5/2026	high
97912	SUSE SLES12 Security Update : apache2 (SUSE-SU-2017:0797-1)	Nessus	SuSE Local Security Checks	3/23/2017	12/29/2025	high
99952	EulerOS 2.0 SP2 : httpd (EulerOS-SA-2017-1086)	Nessus	Huawei Local Security Checks	5/3/2017	12/22/2025	high
289502	MiracleLinux 4 : httpd24-httpd-2.4.25-9.AXS4 (AXSA:2017-1637:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
96451	Apache 2.4.x < 2.4.25 Multiple Vulnerabilities (httpoxy)	Nessus	Web Servers	1/12/2017	1/6/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high