Security restrictions bypass in Apache HTTP Server - CVE-2018-17199

Vulnerability identifier: #VU17178

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17199

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to mod_session checks the session expiry time before decoding the session. A remote attacker сan cause session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded and reuse old session credentials or session IDs, which the attacker could use to access web pages previously accessed by a targeted user. 

Apache HTTP Server
JBoss Core Services
Arch Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Slackware Linux
Opensuse
Tenable.sc
Red Hat Software Collections
apache2 (Debian package)
apache2 (Alpine package)
httpd (Red Hat package)
apache2 (Ubuntu package)
Dell Secure Connect Gateway
Data Computing Appliance (DCA)
Maximo Application Suite - IoT Component
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Update to version 2.4.38.

Apache HTTP Server - update to 2.4.38
Tenable.sc - update to 5.13.0
apache2 (Debian package) - update to 2.4.25-3+deb9u7
apache2 (Alpine package) - update to 2.4.38-r0
httpd (Red Hat package) - update to 2.4.6-93.el7
apache2 (Ubuntu package) - addressed in versions 2.4.7-1ubuntu4.22, 2.4.18-2ubuntu3.10, 2.4.29-1ubuntu4.6, 2.4.34-1ubuntu2.1
Dell Secure Connect Gateway - update to 5.12.00.10
Data Computing Appliance (DCA) - update to 4.3.0.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6

• https://httpd.apache.org/security/vulnerabilities_24.html

• Multiple vulnerabilities in Apache HTTP Server
• Slackware Linux update for httpd
• Arch Linux update for apache
• Debian update for apache2
• Ubuntu update for Apache HTTP Server
• OpenSUSE Linux update for apache2
• OpenSUSE Linux update for apache2
• Amazon Linux AMI update for httpd24
• Gentoo update for Apache
• Red Hat JBoss Core Services update for Apache HTTP Server 2.4.37
• Red Hat JBoss Core Services update for Apache HTTP Server 2.4.37 (RHEL 6)
• Red Hat JBoss Core Services update Apache HTTP Server 2.4.37 (RHEL 7)
• Red Hat Software Collections update for httpd24-httpd
• Multiple vulnerabilities in Tenable.sc
• Red Hat Enterprise Linux 7 update for httpd
• Security restrictions bypass in apache2 (Alpine package)
• Red Hat Enterprise Linux 8 update for the httpd:2.4 module
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component