Out-of-bound read in apache2 (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2017-7668 |
| CWE-ID | CWE-125 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
apache2 (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Out-of-bound read
EUVDB-ID: #VU7117
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-7668
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing token lists within ap_find_token() function. A remote unauthenticated attacker can create a specially crafted sequence of HTTP headers and refer to data past the end of the search string.
Successful exploitation of this vulnerability results segmentation fault and web server crash.
MitigationInstall update from vendor's website.
Vulnerable software versionsapache2 (Alpine package): 2.4.25-r0 - 2.4.25-r1
External linkshttp://git.alpinelinux.org/aports/commit/?id=33c9b879e1ac2712ea308a9c9e642d83b54d690d
http://git.alpinelinux.org/aports/commit/?id=123bd575ef649725247a39822c96929fc1d5e06b
http://git.alpinelinux.org/aports/commit/?id=a565b281e6104e1e1f7ec2b18e1e43353c71a483
http://git.alpinelinux.org/aports/commit/?id=c930c29f44d1c8c27a01acc3e871b48922d3b620
http://git.alpinelinux.org/aports/commit/?id=f0f780e35d42ebf1bbacad2015da18bf1c42dc74
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
