SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache HTTPD Vendors:   Apache Software Foundation
(Red Hat Issues Fix) Apache HTTPD Multiple Flaws Let Remote Users Deny Service, Conduct HTTP Response Splitting Attacks, and Access and Modify Session Data
SecurityTracker Alert ID:  1038365
SecurityTracker URL:  http://securitytracker.com/id/1038365
CVE Reference:   CVE-2016-0736, CVE-2016-2161, CVE-2016-8743   (Links to External Site)
Date:  Apr 26 2017
Impact:   Denial of service via network, Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.4.25
Description:   Multiple vulnerabilities were reported in Apache HTTPD. A remote user can access or modify session data. A remote user can cause the target service to crash. A remote user can conduct HTTP response splitting attacks.

The server does not strictly parse HTTP header data [CVE-2016-8743]. A remote user can submit a specially crafted URL to cause the target server to return a split response. A remote user can exploit this to spoof content on the target server, attempt to poison any intermediate web caches, or conduct cross-site scripting attacks.

A remote user can supply specially crafted data to mod_session_crypto to conduct a padding oracle attack and potentially access and modify session data [CVE-2016-0736].

A remote user can supply specially crafted data to mod_auth_digest to cause the target service to crash [CVE-2016-2161].

Alexander Neumann of RedTeam Pentesting, Maksim Malyutin, David Dennerline at IBM Security's X-Force Researchers, and Regis Leroy reported these vulnerabilities.

Impact:   A remote user can access or modify session data.

A remote user can cause the target service to crash.

A remote user can create a URL that, when loaded by the target user, will cause arbitrary content to be displayed.

A remote user may be able to poison any intermediate web caches with arbitrary content.

Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

https://access.redhat.com/errata/RHSA-2017:1161

Vendor URL:  access.redhat.com/errata/RHSA-2017:1161 (Links to External Site)
Cause:   Access control error, Authentication error, Input validation error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  6, 6.7, 7

Message History:   This archive entry is a follow-up to the message listed below.
Dec 21 2016 Apache HTTPD Multiple Flaws Let Remote Users Deny Service, Conduct HTTP Response Splitting Attacks, and Access and Modify Session Data



 Source Message Contents

Subject:  [RHSA-2017:1161-01] Moderate: httpd24-httpd security, bug fix, and enhancement update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: httpd24-httpd security, bug fix, and enhancement update
Advisory ID:       RHSA-2017:1161-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2017:1161
Issue date:        2017-04-26
CVE Names:         CVE-2016-0736 CVE-2016-1546 CVE-2016-2161 
                   CVE-2016-8740 CVE-2016-8743 
=====================================================================

1. Summary:

Updated httpd24 packages are now available as a part of Red Hat Software
Collections 2.4 for Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

3. Description:

The Apache HTTP Server is a powerful, efficient, and extensible web server.
The httpd24 packages provide a recent stable release of version 2.4 of the
Apache HTTP Server, along with the mod_auth_kerb module.

The httpd24 Software Collection has been upgraded to version 2.4.25, which
provides a number of bug fixes and enhancements over the previous version.
For detailed changes, see the Red Hat Software Collections 2.4 Release
Notes linked from the References section. (BZ#1404778)

Security Fix(es):

* It was discovered that the mod_session_crypto module of httpd did not use
any mechanisms to verify integrity of the encrypted session data stored in
the user's browser. A remote attacker could use this flaw to decrypt and
modify session data using a padding oracle attack. (CVE-2016-0736)

* A denial of service flaw was found in httpd's mod_http2 module. A remote
attacker could use this flaw to block server threads for long times,
causing starvation of worker threads, by manipulating the flow control
windows on streams. (CVE-2016-1546)

* It was discovered that the mod_auth_digest module of httpd did not
properly check for memory allocation failures. A remote attacker could use
this flaw to cause httpd child processes to repeatedly crash if the server
used HTTP digest authentication. (CVE-2016-2161)

* It was discovered that the HTTP parser in httpd incorrectly allowed
certain characters not permitted by the HTTP protocol specification to
appear unencoded in HTTP request headers. If httpd was used in conjunction
with a proxy or backend server that interpreted those characters
differently, a remote attacker could possibly use this flaw to inject data
into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad
Request" error to HTTP clients which do not strictly follow HTTP protocol
specification. A newly introduced configuration directive
"HttpProtocolOptions Unsafe" can be used to re-enable the old less strict
parsing. However, such setting also re-introduces the CVE-2016-8743 issue.

* A vulnerability was found in httpd's handling of the LimitRequestFields
directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker
could send crafted requests with headers larger than the server's available
memory, causing httpd to crash. (CVE-2016-8740)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1329639 - error in service httpd24-httpd configtest
1335616 - Backport Apache PR58118 to fix mod_proxy_fcgi spamming non-errors: AH01075: Error dispatching request to : (passing brigade to output filters)
1336350 - CVE-2016-1546 httpd: mod_http2 denial-of-service by thread starvation
1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
1414037 - mod_proxy_fcgi regression in 2.4.23+
1432249 - must fail startup with conflicting Listen directives
1433474 - wrong requires  of httpd24-httpd and  httpd24-httpd-tools

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-0736
https://access.redhat.com/security/cve/CVE-2016-1546
https://access.redhat.com/security/cve/CVE-2016-2161
https://access.redhat.com/security/cve/CVE-2016-8740
https://access.redhat.com/security/cve/CVE-2016-8743
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZAJq1XlSAg2UNWIIRAlGKAJ9zNHkvJQ9/I+imHbgRwjelvV9xKgCeLyYO
SjFZr+hN7gjeQOgcC0kswCY=
=m+ZH
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC