Padding oracle attack in Apache HTTP Server - CVE-2016-0736

Vulnerability identifier: #VU1800

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0736

CWE-ID: CWE-696

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.

Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.

Apache HTTP Server
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Ubuntu
Fedora
httpd
IBM Cloud Pak for Business Automation

The vulnerability is fixed in Apache HTTP Server 2.4.25.

httpd - addressed in versions 2.4.25-1.fc24, 2.4.25-1.fc25
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003

• Exploit #626 - Apache mod_session_crypto - Padding Oracle (March 18, 2020)

• http://httpd.apache.org/security/vulnerabilities_24.html

• Multiple vulnerabilities in Apache HTTP Server
• Red Hat update for Apache HTTP Server
• Ubuntu update for Apache HTTP Server
• Slackware Linux update for httpd
• Amazon Linux AMI update for httpd24
• Red Hat update for httpd
• Fedora 25 update for httpd
• Fedora 24 update for httpd
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation