NULL pointer dereference in Apache HTTP Server - CVE-2017-7659

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU7118

NULL pointer dereference in Apache HTTP Server - CVE-2017-7659

Published: June 20, 2017 / Updated: June 20, 2017


Vulnerability identifier: #VU7118
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7659
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a NULL pointer dereference error within mod_http2. A remote attacker can send a specially crafted HTTP/2 request and crash the affected process.

Successful exploitation of the vulnerability result in denial of service (DoS) attack.


Affected software

Apache HTTP Server
Arch Linux
Amazon Linux AMI
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Slackware Linux
Fedora
Tenable.sc
apache2 (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
httpd
firefox (Red Hat package)
Dell Secure Connect Gateway

How to mitigate CVE-2017-7659

Update to version 2.4.26.

Tenable.sc - update to 5.13.0
apache2 (Alpine package) - update to 2.4.26-r0
Dell Secure Connect Gateway - update to 5.12.00.10
httpd - addressed in versions 2.4.26-1.fc24, 2.4.26-1.fc25, 2.4.26-1.fc26, 2.4.27-1.fc25, 2.4.27-2.fc25
firefox (Red Hat package) - update to 115.13.0-3.el8_4

External References

Related Security Bulletins