#VU1800 Padding oracle attack in Apache HTTP Server - CVE-2016-0736
Published: December 21, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU1800
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2016-0736
CWE-ID: CWE-696
Exploitation vector: Adjecent network
Exploit availability:
Public exploit is available
Vulnerable software:
Apache HTTP Server
Apache HTTP Server
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.
Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.
The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.
Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.
Remediation
The vulnerability is fixed in Apache HTTP Server 2.4.25.