Padding oracle attack in Apache HTTP Server - CVE-2016-0736

 

Padding oracle attack in Apache HTTP Server - CVE-2016-0736

Published: December 21, 2016 / Updated: September 14, 2018


Vulnerability identifier: #VU1800
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2016-0736
CWE-ID: CWE-696
Exploitation vector: Adjecent network
Exploit availability: Public exploit is available
Vendor: Apache Foundation
Affected software:
Apache HTTP Server

Detailed vulnerability description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.

Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.

How to mitigate CVE-2016-0736

The vulnerability is fixed in Apache HTTP Server 2.4.25.

Sources