Spoofing attack in Apache HTTP Server - CVE-2016-8743

Vulnerability identifier: #VU1961

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-8743

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient sanitization of HTTP request, which contain whitespace characters. A remote attacker can send a specially crafted HTTP request, containing CR, FF, VTAB characters followed by CRLF sequence and inject arbitrary data in server response.

Successful exploitation of this vulnerability may result in content spoofing, web cache poisoning and XSS attacks.

Apache HTTP Server
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Ubuntu
Slackware Linux
Fedora
httpd

Install the latest version Apache HTTP Server 2.4.25 or 2.2.32.

httpd - addressed in versions 2.4.25-1.fc24, 2.4.25-1.fc25

• http://httpd.apache.org/security/vulnerabilities_24.html
• http://www.apache.org/dist/httpd/CHANGES_2.2.32

• Multiple vulnerabilities in Apache HTTP Server
• Red Hat update for Apache HTTP Server
• Ubuntu update for Apache HTTP Server
• Ubuntu update for Apache HTTP Server
• Slackware Linux update for httpd
• Amazon Linux AMI update for httpd24
• Amazon Linux AMI update for httpd
• Amazon Linux AMI update for httpd24
• Red Hat update for httpd
• Fedora 25 update for httpd
• Fedora 24 update for httpd