Use-after-free in Apache HTTP Server - CVE-2017-9798

Vulnerability identifier: #VU8504

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9798

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to use-after-free error when processing HTTP OPTIONS requests in server/core.c, when limits are configured in .htaccess or httpd.conf configuration files. A remote unauthenticated attacker can read portions of memory through HTTP OPTIONS requests and gain access to potentially sensitive data.

The vulnerability is dubbed Optionsbleed.

Apache HTTP Server
JBoss Enterprise Web Server
Arch Linux
Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
macOS
Ubuntu
Slackware Linux
Fedora
Opensuse
JBoss Core Services
JBoss Enterprise Application Platform
Tenable.sc
apache2 (Alpine package)
httpd (Red Hat package)
httpd
Tivoli Network Manager IP Edition
Data Computing Appliance (DCA)
IBM API Connect
Dell Secure Connect Gateway
Oracle Communications Diameter Signaling Router (DSR)

Update to version 2.4.28.
http://www.apache.org/dist/httpd/CHANGES_2.4.28

Tenable.sc - update to 5.13.0
apache2 (Alpine package) - update to 2.4.27-r1
IBM API Connect - update to 5.0.8.12
Dell Secure Connect Gateway - update to 5.12.00.10
httpd (Red Hat package) - update to 2.4.6-40.el7_2.6
httpd - addressed in versions 2.4.27-3.fc26, 2.4.27-4.fc25, 2.4.27-8.fc27, 2.4.29-1.fc25
Data Computing Appliance (DCA) - update to 3.5.2.0

• Exploit #2298 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
• Exploit #1999 - Alien-Framework (Alien-Framework, it is a framework with many CVE exploits and tools to use in pen-testing.) (March 18, 2020)
• Exploit #62 - Apache Optionsbleed Scanner (March 18, 2020)
• Exploit #1326 - Apache < 2.2.34 / < 2.4.27 - HTTP OPTIONS Memory Leak (March 18, 2020)

• https://svn.apache.org/viewvc?view=revision&amp;revision=1807655 
• https://github.com/hannob/optionsbleed
• http://openwall.com/lists/oss-security/2017/09/18/2
• https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory....
• http://www.apache.org/dist/httpd/CHANGES_2.4.28

• Use-after-free in Apache HTTP Server
• Arch Linux update for apache
• Ubuntu update for Apache HTTP Server
• Debian update for apache2
• Slackware Linux update for httpd
• Ubuntu update for Apache HTTP Server
• Gentoo update for Apache
• Amazon Linux AMI update for httpd24, httpd
• Multiple vulnerabilities in Apple macOS/OS X
• Red Hat update for Apache
• Red Hat update for Apache
• Red Hat update for Apache
• OpenSUSE Linux update for virtualbox
• Red Hat update for Red Hat JBoss Enterprise Application Platform 6.4.18
• Red Hat update for httpd
• Red Hat update for httpd
• Red Hat update for Red Hat JBoss Web Server
• Red Hat update for httpd
• Red Hat update for httpd
• Multiple vulnerabilities in Tenable.sc
• Use-after-free in apache2 (Alpine package)
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Fedora 25 update for httpd
• Fedora 26 update for httpd
• Fedora 27 update for httpd
• Fedora 25 update for httpd
• Red Hat Enterprise Linux 7 update for httpd
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)