Padding oracle attack in Apache HTTP Server - CVE-2016-0736
Published: December 21, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU1800
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2016-0736
CWE-ID: CWE-696
Exploitation vector: Adjecent network
Exploit availability:
Public exploit is available
Vendor: Apache Foundation
Affected software:
Apache HTTP Server
Apache HTTP Server
Detailed vulnerability description
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.
Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.
The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.
Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.
How to mitigate CVE-2016-0736
The vulnerability is fixed in Apache HTTP Server 2.4.25.