Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2015-3183 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU33821
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2015-3183
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
httpd-devel-2.2.31-1.6.amzn1.i686
mod_ssl-2.2.31-1.6.amzn1.i686
httpd-tools-2.2.31-1.6.amzn1.i686
httpd-debuginfo-2.2.31-1.6.amzn1.i686
httpd-2.2.31-1.6.amzn1.i686
noarch:
httpd-manual-2.2.31-1.6.amzn1.noarch
src:
httpd-2.2.31-1.6.amzn1.src
x86_64:
httpd-debuginfo-2.2.31-1.6.amzn1.x86_64
httpd-devel-2.2.31-1.6.amzn1.x86_64
httpd-tools-2.2.31-1.6.amzn1.x86_64
mod_ssl-2.2.31-1.6.amzn1.x86_64
httpd-2.2.31-1.6.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2015-578.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.