Improper access control in Red Hat Enterprise Linux for x86_64 - CVE-2017-12171

Vulnerability identifier: #VU8907

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12171

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists in Apache HTTPD on Red Hat Enterprise Linux due to improper parsing of comments in the "Allow" and "Deny" configuration lines. A remote attacker can bypass security restrictions and access an ostensibly restricted HTTP resource.

Red Hat Enterprise Linux for x86_64
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Data Computing Appliance (DCA)

Install update from vendor's website.

Data Computing Appliance (DCA) - update to 3.5.2.0

• https://access.redhat.com/security/cve/CVE-2017-12171

• Security restrictions bypass in Red Hat Enterprise Linux
• Amazon Linux AMI update for httpd
• Red Hat update for httpd
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)