Russian Vulnerability Scanner Database

Back to List

BDU:2018-00103

Scores

EPSS

0.000None
0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

5.3Medium
3.x
0246810

CVSS Score: 5.3/10

All CVSS Scores

CVSS 3.x
5.3

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 2.0
5.0

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

Уязвимость функции ap_limit_section httpd-демона веб-сервера Apache HTTP Server связана с использованием памяти после ее освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к данным из памяти процесса с помощью специально сформированного HTTP-запроса

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

bdu

Related Vulnerabilities

CVE-2017-9798

Reference Links

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9798
http://openwall.com/lists/oss-security/2017/09/18/2
http://www.debian.org/security/2017/dsa-3980
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/100872
http://www.securitytracker.com/id/1039387
httpd.apache.org%3E
httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798
httpd/
httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
httpd/commit/29afdd2550b3d30a8defece2b95ae81edcf66ac9
httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a
https://
https://access.redhat.com/errata/RHSA-2017:2882
https://access.redhat.com/errata/RHSA-2017:2972
https://access.redhat.com/errata/RHSA-2017:3018
https://access.redhat.com/errata/RHSA-2017:3113
https://access.redhat.com/errata/RHSA-2017:3114
https://access.redhat.com/errata/RHSA-2017:3193
https://access.redhat.com/errata/RHSA-2017:3194
https://access.redhat.com/errata/RHSA-2017:3195
https://access.redhat.com/errata/RHSA-2017:3239
https://access.redhat.com/errata/RHSA-2017:3240
https://access.redhat.com/errata/RHSA-2017:3475
https://access.redhat.com/errata/RHSA-2017:3476
https://access.redhat.com/errata/RHSA-2017:3477
https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
https://github.com/apache/
https://github.com/hannob/optionsbleed
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba
%3Ccvs.
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830
%3Ccvs.
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f
%3Ccvs.
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53
%3Ccvs.
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7
%3Ccvs.
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f
%3Ccvs.
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234
%3Ccvs.
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b
%3Ccvs.
https://nvd.nist.gov/vuln/detail/CVE-2017-9798
https://security.gentoo.org/glsa/201710-32
https://security-tracker.debian.org/tracker/CVE-2017-9798
https://svn.apache.org/viewvc/
https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
https://www.exploit-db.com/exploits/42745/
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.securitycode.ru/company/blog/daydzhest-laboratorii-analiza-setevykh-ugroz-kod-bezopasnosti-za-mart-2025/

Recommendations

Source: bdu

Использование рекомендаций:
Для Apache HTTP Server:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798

Для Debian:
Обновление программного обеспечения (пакета apache2) до 2.4.38-3+deb10u4 или более поздней версии

Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2017-9798

Для Ubuntu:
https://ubuntu.com/security/notices/USN-3425-1
https://ubuntu.com/security/notices/USN-3425-2

Для Astra Linux:
https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16

URL: https://bdu.fstec.ru/vul/2018-00103

Vulnerable Software (176)

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: debian gnu/linux 9

Trait: 
{
  "version_end_including": "2.2.34"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: red hat enterprise linux 7.3 Extended Update Support

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: ubuntu 14.04 ESM

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4.0"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: ubuntu 14.04 ESM

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: astra 2.12

Trait: 
{
  "version_end_including": "2.2.34"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: astra 2.12

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4.0"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: astra 2.12

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: ubuntu 17.04

Trait: 
{
  "version_end_including": "2.2.34"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: ubuntu 17.04

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4.0"
}

Source: bdu

Type: Configuration

Vendor: apache software foundation

Product: apache http server

Operating System: ubuntu 17.04

Trait: 
{
  "version_end_including": "2.4.27",
  "version_start_including": "2.4"
}

Source: bdu