Improper input validation in Apache HTTP Server - CVE-2016-2161

Vulnerability identifier: #VU1886

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2161

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause denial of service attack.

The vulnerability exists due to input validation error in mod_auth_digest module when parsing malicious HTTP requests. A remote attacker can send a specially crafted HTTP request to affected server and cause server crash.

Successful exploitation of the vulnerability will result in crash of each server instance.

Apache HTTP Server
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Ubuntu
Fedora
httpd
XtremIO X2

Install the latest version Apache HTTP Server 2.4.25.

httpd - addressed in versions 2.4.25-1.fc24, 2.4.25-1.fc25
XtremIO X2 - update to 6.4.2-13

• http://httpd.apache.org/security/vulnerabilities_24.html

• Multiple vulnerabilities in Apache HTTP Server
• Red Hat update for Apache HTTP Server
• Ubuntu update for Apache HTTP Server
• Slackware Linux update for httpd
• Amazon Linux AMI update for httpd24
• Red Hat update for httpd
• Multiple vulnerabilities in Dell XtremIO X2
• Fedora 25 update for httpd
• Fedora 24 update for httpd