Out-of-bounds write in Apache HTTP Server - CVE-2017-15710
Published: March 27, 2018 / Updated: July 14, 2018
Vulnerability identifier: #VU11283
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15710
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in HTTPD mod_authnz_ldap due to improper validation of user-supplied input. A remote attacker can send a specially crafted Accept-Language header value, trigger an out-of-bounds memory write error and potentially cause the target service to crash.
The weakness exists in HTTPD mod_authnz_ldap due to improper validation of user-supplied input. A remote attacker can send a specially crafted Accept-Language header value, trigger an out-of-bounds memory write error and potentially cause the target service to crash.
Affected software
Apache HTTP Server
Arch Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
SUSE Linux
Ubuntu
Fedora
httpd (Red Hat package)
apache2 (Alpine package)
apache2-bin (Ubuntu package)
httpd
Tenable.sc
IBM API Connect
Dell Secure Connect Gateway
Data Computing Appliance (DCA)
Arch Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
SUSE Linux
Ubuntu
Fedora
httpd (Red Hat package)
apache2 (Alpine package)
apache2-bin (Ubuntu package)
httpd
Tenable.sc
IBM API Connect
Dell Secure Connect Gateway
Data Computing Appliance (DCA)
How to mitigate CVE-2017-15710
Update to version 2.4.32.
Apache HTTP Server - update to 2.4.32
httpd (Red Hat package) - update to 2.4.6-93.el7
Tenable.sc - update to 5.13.0
IBM API Connect - update to 5.0.8.12
Dell Secure Connect Gateway - update to 5.12.00.10
apache2 (Alpine package) - update to 2.4.33-r0
apache2-bin (Ubuntu package) - addressed in versions 2.4.7-1ubuntu4.20, 2.4.18-2ubuntu3.8, 2.4.27-2ubuntu4.1
httpd - addressed in versions 2.4.33-2.fc26, 2.4.33-2.fc27, 2.4.33-2.fc28, 2.4.33-4.fc26
Data Computing Appliance (DCA) - update to 4.3.0.0
httpd (Red Hat package) - update to 2.4.6-93.el7
Tenable.sc - update to 5.13.0
IBM API Connect - update to 5.0.8.12
Dell Secure Connect Gateway - update to 5.12.00.10
apache2 (Alpine package) - update to 2.4.33-r0
apache2-bin (Ubuntu package) - addressed in versions 2.4.7-1ubuntu4.20, 2.4.18-2ubuntu3.8, 2.4.27-2ubuntu4.1
httpd - addressed in versions 2.4.33-2.fc26, 2.4.33-2.fc27, 2.4.33-2.fc28, 2.4.33-4.fc26
Data Computing Appliance (DCA) - update to 4.3.0.0
External References
Related Security Bulletins
- Multiple vulnerabilities in Apache HTTP Server
- Debian update for apache2
- Arch Linux update for apache
- SUSE Linux update for apache2
- SUSE Linux update for apache2
- Amazon Linux AMI update for httpd24
- Multiple vulnerabilities in Tenable.sc
- Red Hat Enterprise Linux 7 update for httpd
- Out-of-bounds write in apache2 (Alpine package)
- Multiple vulnerabilities in DELL Secure Connect Gateway Security
- Multiple vulnerabilities in IBM API Connect
- Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
- Fedora 28 update for httpd
- Fedora 27 update for httpd
- Fedora 26 update for httpd
- Fedora 26 update for httpd
- Ubuntu update for apache2