Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Try our Premium Alert Service
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service

Category:   Application (Web Server/CGI)  >   Apache HTTPD Vendors:   Apache Software Foundation
Apache HTTPD HTTP/2 Certificate Validation Flaw Lets Remote Users Bypass Client Certificate Authentication on the Target System
SecurityTracker Alert ID:  1036225
SecurityTracker URL:
CVE Reference:   CVE-2016-4979   (Links to External Site)
Date:  Jul 5 2016
Impact:   Host/resource access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.4.18 through 2.4.20
Description:   A vulnerability was reported in Apache HTTPD. A remote user can bypass client certificate authentication.

The web server's experimental module for HTTP/2 (mod_http2) does not properly validate an X.509 client. A remote user can bypass client certificate authentication to access web resources on the target system.

Systems using the mod_http2 module and with the h2 and h2c protocols activated in the configuration are affected.

The vendor was notified on June 30, 2016.

Erki Aring from Liewenthal Electronics Ltd reported this vulnerability.

Impact:   A remote user can bypass client certificate authentication.
Solution:   The vendor has issued a fix (2.4.23).
Vendor URL: (Links to External Site)
Cause:   Authentication error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jul 18 2016 (Red Hat Issues Fix) Apache HTTPD HTTP/2 Certificate Validation Flaw Lets Remote Users Bypass Client Certificate Authentication on the Target System
Red Hat has issued a fix for Red Hat Enterprise Linux 6, 6.6, 6.7, 7, 7.1, and 7.2.
Oct 19 2016 (Oracle Issues Fix for Oracle Enterprise Manager) Apache HTTPD HTTP/2 Certificate Validation Flaw Lets Remote Users Bypass Client Certificate Authentication on the Target System
Oracle has issued a fix for Oracle Enterprise Manager.

 Source Message Contents

Subject:  CVE-2016-4979: HTTPD webserver - X509 Client certificate based authentication can be bypassed when HTTP/2 is used [vs]

Hash: SHA1

          Security Advisory - Apache Software Foundation
                Apache HTTPD WebServer  /

	X509 Client certificate based authentication can
           be bypassed when HTTP/2 is used

                   CVE-2016-4979 / CVSS 7.5

The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509 
client certificate correctly when experimental module for the HTTP/2 
protocol is used to access a resource. 

The net result is that a resource that should require a valid client certificate
in order to get access can be accessed without that credential.

- -----------

Apache can control access to resources based on various things; such as 
a password, IP address and so on. One of the options, when SSL or TLS is
used, is gating access based on the client having access to a private-key of 
a X509 client certificate. These client certificates are typically held on
a chipcard (e.g. the CAC card in the US, national identity, banking cards
or, for example, medical-chip cards in Europe). In some cases they
are 'soft tokens' - i.e. files, often called PKCS#12 files, which are loaded
into the browser or the 'keychain'.

Gating access based on a client certificate is done by adding a line such as

	SSLVerifyClient require 

to the httpd configuration; along with a list of trusted client certificate
authorities (SSLCACertificateFile).

Version 2.4.17 of the Apache HTTP Server introduced an experimental feature:
mod_http2 for the HTTP/2 protocol (RFC7540, previous versions were known as 
Google SPDY).

This module is NOT compiled in by default -and- is not enabled by default, 
although some distribution may have chosen to do so.

It is generally needs to be enabled in the 'Protocols' line in httpd by 
adding 'h2' and/or 'h2c' to the 'http/1.1' only default. 

The default distributions of the Apache Software Foundation do not include 
this experimental feature. 

- --------

- From version 2.4.18, upto and including version 2.4.20 the server failed
to take the (failed/absent) client certificate validation into account
when providing access to a resource over HTTP/2. This issue has been fixed 
in version 2.4.23 (r1750779).

As a result - a resource thought to be secure and requiring a valid
client certificate - would be accessible without authentication 
provided that the mod_http2 was loaded, h2 or h2c activated, that
that the browser used the HTTP/2 protocol and it would do more than
one request over a given connection.

- -------

A third party can gain access to resources on the web server without
the requisite credentials.

This can then lead to unauthorised disclosure of information.

Versions affected: 
- ------------------
All versions from  2.4.18 to  2.4.20. The issue is fixed in
version 2.4.23 (released 2015-6-5)

- -----------

Upgrade to version 2.4.23 or newer.

Mitigations and work arounds:
- -----------------------------

As a temporary workaround - HTTP/2 can be disabled by changing
the configuration by removing h2 and h2c from the Protocols
line(s) in the configuration file. 

The resulting line should read:

		Protocols http/1.1

Credits and timeline
- --------------------

The flaw was found and reported by Erki Aring <> 
from Liewenthal Electronics Ltd on 2016-06-30. The issue was 
resolved by Stefan Eissing that same day and incorporated in 
the  release of 5th of July 2015 (thus avoiding a bank holiday).
Apache would like to thank all involved for their help with this.

Common Vulnerability Scoring (Version 3) and vector
- ---------------------------------------------------


CVSS Base Score         7.5
CVSS Temporal Score     7.0 

1.05 / : 2339 $
Version: GnuPG v1.4
Comment: This message is encrypted and/or signed with PGP (gnu-pg, gpg). Contact if you cannot read it.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, LLC