Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   Apache HTTPD Vendors:   Apache Software Foundation
Apache HTTPD mod_authnz_ldap Out-of-bounds Memory Write Error Lets Remote Users Cause the Target Service to Crash
SecurityTracker Alert ID:  1040569
SecurityTracker URL:
CVE Reference:   CVE-2017-15710   (Links to External Site)
Date:  Mar 26 2018
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, 2.4.0 to 2.4.29
Description:   A vulnerability was reported in Apache HTTPD mod_authnz_ldap. A remote user can cause the target service to crash.

A remote user can send a specially crafted Accept-Language header value to trigger an out-of-bounds memory write error and potentially cause the target service to crash.

Systems using mod_authnz_ldap configured with AuthLDAPCharsetConfig are affected.

Alex Nichols and Jakob Hirsch reported this vulnerability.

Impact:   A remote user can cause the target service to crash.
Solution:   The vendor has issued a fix (2.4.30).

A patch (CVE-2017-15710.patch) is also available for version 2.2.x.

The vendor advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values

CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values.

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
httpd 2.0.23 to 2.0.65
httpd 2.2.0 to 2.2.34
httpd 2.4.0 to 2.4.29


mod_authnz_ldap, if configured with AuthLDAPCharsetConfig,
uses the Accept-Language header value to lookup the right charset encoding
when verifying the user's credentials.
If the header value is not present in the charset conversion
table, a fallback mechanism is used to truncate it to a two
characters value to allow a quick retry (for example, 'en-US' is truncated
to 'en'). A header value of less than two characters forces an out of bound
write of one NUL byte to a memory location that is not part of the string.
In the worst case, quite unlikely, the process would crash which could
be used as a Denial of Service attack. In the more likely case, this memory is
already reserved for future use and the issue has no effect at all."

All httpd users should upgrade to 2.4.30 or later.

Users of (the now end-of-life) httpd 2.2 who cannot upgrade at this time should
apply CVE-2017-15710.patch, which is available at

The Apache HTTP Server security team would like to thank Alex Nichols
and Jakob Hirsch for reporting this issue.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC