Sign-up

ID

VAR-201706-0271


CVE

CVE-2017-3169


TITLE

Apache httpd In NULL Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-005024

DESCRIPTION

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Apache httpd Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apache HTTP Server is prone to a denial-of-service vulnerability. Attackers may leverage this issue to cause a denial-of-service condition, denying service to legitimate users. The following versions are vulnerable: Apache HTTP Server 2.2.0 to 2.2.32 Apache HTTP Server 2.4.0 to 2.4.25. ========================================================================== Ubuntu Security Notice USN-3373-1 July 31, 2017 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in Apache HTTP Server. This update adds a new ap_get_basic_auth_components() function for use by third-party modules. (CVE-2017-3169) Javier JimA(c)nez discovered that the Apache HTTP Server incorrectly handled parsing certain requests. (CVE-2017-7679) David Dennerline and RA(c)gis Leroy discovered that the Apache HTTP Server incorrectly handled unusual whitespace when parsing requests, contrary to specifications. This update may introduce compatibility issues with clients that do not strictly follow HTTP protocol specifications. A new configuration option "HttpProtocolOptions Unsafe" can be used to revert to the previous unsafe behaviour in problematic environments. (CVE-2016-8743) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: A apache2.2-binA A A A A A A A A A A A A A A A A A A 2.2.22-1ubuntu1.12 In general, a standard system update will make all the necessary changes. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es): * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak. JIRA issues fixed (https://issues.jboss.org/): JBCS-403 - Errata for httpd 2.4.23.SP3 RHEL6 7. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: httpd24-httpd security update Advisory ID: RHSA-2017:2483-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2483 Issue date: 2017-08-16 CVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 ===================================================================== 1. Summary: An update for httpd24-httpd is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788) * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167) * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP/2 request. (CVE-2017-7659) * A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668) * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3): Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-3167 https://access.redhat.com/security/cve/CVE-2017-3169 https://access.redhat.com/security/cve/CVE-2017-7659 https://access.redhat.com/security/cve/CVE-2017-7668 https://access.redhat.com/security/cve/CVE-2017-7679 https://access.redhat.com/security/cve/CVE-2017-9788 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZlNCpXlSAg2UNWIIRArzwAJwNfAuroR6X18rUh+zmjiMy5iBkdwCeJF6e 4v4GwWYC+5xG0xxXzTEQyAg= =UV+2 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2017-7679) * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. (CVE-2017-9798) Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. 6) - i386, noarch, x86_64 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files)

Trust: 2.61

sources: NVD: CVE-2017-3169 // JVNDB: JVNDB-2017-005024 // BID: 99134 // VULMON: CVE-2017-3169 // PACKETSTORM: 143561 // PACKETSTORM: 145457 // PACKETSTORM: 143785 // PACKETSTORM: 144960 // PACKETSTORM: 143766 // PACKETSTORM: 145455 // PACKETSTORM: 144969

AFFECTED PRODUCTS

vendor:apachemodel:http serverscope:eqversion:2.2.32

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.3

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.18

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.16

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.18

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.26

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.20

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.24

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.22

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.13

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.15

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.2

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.21

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.31

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.23

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.19

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.30

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.29

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.16

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.2

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.23

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.12

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.12

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.14

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.17

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.11

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.20

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.25

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.1

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.10

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.17

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.27

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.0

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.25

Trust: 1.0

vendor:apachemodel:httpdscope:eqversion:2.4.26

Trust: 0.8

vendor:necmodel:spoolserver/winspool seriesscope:eqversion:reportfiling ver5.2 ~ 6.2

Trust: 0.8

vendor:apachemodel:httpdscope:eqversion:2.2.33

Trust: 0.8

vendor:apachemodel:httpdscope:ltversion:2.2.x

Trust: 0.8

vendor:apachemodel:httpdscope:ltversion:2.4.x

Trust: 0.8

vendor:ubuntumodel:linuxscope:eqversion:17.04

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:16.10

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:16.04

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:14.04

Trust: 0.3

vendor:redhatmodel:software collections for rhelscope:eqversion:0

Trust: 0.3

vendor:redhatmodel:jboss web serverscope:eqversion:0

Trust: 0.3

vendor:redhatmodel:jboss ewsscope:eqversion:2

Trust: 0.3

vendor:redhatmodel:jboss eapscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:jboss core servicesscope:eqversion:1

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc node optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5.0

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.1

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.3

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.2

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:6

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.25

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.23

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.20

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.19

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.18

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.17

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.16

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.14

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.12

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.11

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.4

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.26

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.25

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.24

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.23

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.15

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.14

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.13

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.12

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.11

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.10

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.3

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.3

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.24

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.13

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.1

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.0

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.32

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.29

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.22

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.21

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.20

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.19

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.18

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.17

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.16

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.1

Trust: 0.3

vendor:apachemodel:apachescope:neversion:2.4.26

Trust: 0.3

vendor:apachemodel:2.2.33-devscope:neversion: -

Trust: 0.3

sources: BID: 99134 // JVNDB: JVNDB-2017-005024 // NVD: CVE-2017-3169

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-3169
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-3169
value: CRITICAL

Trust: 0.8

VULMON: CVE-2017-3169
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-3169
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2017-3169
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULMON: CVE-2017-3169 // JVNDB: JVNDB-2017-005024 // NVD: CVE-2017-3169

PROBLEMTYPE DATA

problemtype:CWE-476

Trust: 1.8

sources: JVNDB: JVNDB-2017-005024 // NVD: CVE-2017-3169

THREAT TYPE

remote

Trust: 0.4

sources: PACKETSTORM: 143785 // PACKETSTORM: 144960 // PACKETSTORM: 143766 // PACKETSTORM: 144969

TYPE

Failure to Handle Exceptional Conditions

Trust: 0.3

sources: BID: 99134

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005024

PATCH
title:NV17-014url:http://jpn.nec.com/security-info/secinfo/nv17-014.html
Trust: 0.8
title:CVE-2017-3169: mod_ssl null pointer dereferenceurl:https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E
Trust: 0.8
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173476 - Security Advisory
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173477 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173195 - Security Advisory
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173475 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173193 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173194 - Security Advisory
Trust: 0.1
title:Red Hat: CVE-2017-3169url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2017-3169
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2017-3169
Trust: 0.1
title:Ubuntu Security Notice: apache2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3340-1
Trust: 0.1
title:Ubuntu Security Notice: apache2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3373-1
Trust: 0.1
title:Debian Security Advisories: DSA-3896-1 apache2 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=a100e91e6529637522c4f74492953f8c
Trust: 0.1
title:Amazon Linux AMI: ALAS-2017-892url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-892
Trust: 0.1
title:Arch Linux Advisories: [ASA-201706-34] apache: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201706-34
Trust: 0.1
title:Amazon Linux AMI: ALAS-2017-863url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-863
Trust: 0.1
title:Symantec Security Advisories: SA154: Apache httpd Vulnerabilities June 2017url:https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=6f891c1513dfb5c26769ed38bcac6e4f
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a22ad41e97bbfc5abb0bb927bf43089c
Trust: 0.1
title:Tenable Security Advisories: [R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2019-09
Trust: 0.1
title:Oracle Linux Bulletins: Oracle Linux Bulletin - July 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=549dc795290b298746065b62b4bb7928
Trust: 0.1
title:Oracle: Oracle Critical Patch Update Advisory - October 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=523d3f220a64ff01dd95e064bd37566a
Trust: 0.1
title:GyoiThonurl:https://github.com/gyoisamurai/GyoiThon 
Trust: 0.1
title:nrichurl:https://github.com/retr0-13/nrich 
Trust: 0.1
title: - url:https://github.com/RoseSecurity-Research/Red-Teaming-TTPs 
Trust: 0.1
title:Red-Teaming-TTPsurl:https://github.com/RoseSecurity/Red-Teaming-TTPs 
Trust: 0.1
title:Shodan-nrichurl:https://github.com/PawanKumarPandit/Shodan-nrich 
Trust: 0.1
title:DC-3-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-3-Vulnhub-Walkthrough 
Trust: 0.1
title:DC-2-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-2-Vulnhub-Walkthrough 
Trust: 0.1
title:DC-1-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-1-Vulnhub-Walkthrough 
Trust: 0.1
title: - url:https://github.com/hrbrmstr/internetdb 
Trust: 0.1
title: - url:https://github.com/SecureAxom/strike 
Trust: 0.1
title:pigaturl:https://github.com/syadg123/pigat 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-3169 // 
            
            
            
            JVNDB: JVNDB-2017-005024

EXTERNAL IDS
db:NVDid:CVE-2017-3169
Trust: 2.9
db:BIDid:99134
Trust: 1.3
db:TENABLEid:TNS-2019-09
Trust: 1.0
db:SECTRACKid:1038711
Trust: 1.0
db:JVNid:JVNVU98416507
Trust: 0.8
db:JVNDBid:JVNDB-2017-005024
Trust: 0.8
db:VULMONid:CVE-2017-3169
Trust: 0.1
db:PACKETSTORMid:143561
Trust: 0.1
db:PACKETSTORMid:145457
Trust: 0.1
db:PACKETSTORMid:143785
Trust: 0.1
db:PACKETSTORMid:144960
Trust: 0.1
db:PACKETSTORMid:143766
Trust: 0.1
db:PACKETSTORMid:145455
Trust: 0.1
db:PACKETSTORMid:144969
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-3169 // 
            
            
            
            BID: 99134 // 
            
            
            
            JVNDB: JVNDB-2017-005024 // 
            
            
            
            PACKETSTORM: 143561 // 
            
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 143785 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 144969 // 
            
            
            
            NVD: CVE-2017-3169

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2017-3169
Trust: 1.5
url:https://access.redhat.com/errata/rhsa-2017:3477
Trust: 1.1
url:https://access.redhat.com/errata/rhsa-2017:2483
Trust: 1.1
url:https://access.redhat.com/errata/rhsa-2017:3193
Trust: 1.1
url:https://access.redhat.com/errata/rhsa-2017:2478
Trust: 1.1
url:https://access.redhat.com/errata/rhsa-2017:3475
Trust: 1.1
url:https://access.redhat.com/errata/rhsa-2017:3195
Trust: 1.1
url:http://www.debian.org/security/2017/dsa-3896
Trust: 1.0
url:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Trust: 1.0
url:http://www.securityfocus.com/bid/99134
Trust: 1.0
url:http://www.securitytracker.com/id/1038711
Trust: 1.0
url:https://access.redhat.com/errata/rhsa-2017:2479
Trust: 1.0
url:https://access.redhat.com/errata/rhsa-2017:3194
Trust: 1.0
url:https://access.redhat.com/errata/rhsa-2017:3476
Trust: 1.0
url:https://github.com/gottburgm/exploits/tree/master/cve-2017-3169
Trust: 1.0
url:https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3cdev.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://security.gentoo.org/glsa/201710-32
Trust: 1.0
url:https://security.netapp.com/advisory/ntap-20180601-0002/
Trust: 1.0
url:https://support.apple.com/ht208221
Trust: 1.0
url:https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbux03908en_us
Trust: 1.0
url:https://www.nomachine.com/su08o00185
Trust: 1.0
url:https://www.tenable.com/security/tns-2019-09
Trust: 1.0
url:https://access.redhat.com/security/cve/cve-2017-3169
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3169
Trust: 0.8
url:https://jvn.jp/vu/jvnvu98416507/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-3167
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-7679
Trust: 0.7
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.6
url:https://access.redhat.com/security/cve/cve-2017-7679
Trust: 0.6
url:https://access.redhat.com/security/cve/cve-2017-3167
Trust: 0.6
url:https://access.redhat.com/security/team/contact/
Trust: 0.6
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.6
url:https://bugzilla.redhat.com/):
Trust: 0.6
url:https://access.redhat.com/articles/11258
Trust: 0.5
url:https://access.redhat.com/security/team/key/
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2017-9798
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2017-9798
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2017-9788
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2017-9788
Trust: 0.4
url:http://www.apache.org/
Trust: 0.3
url:https://httpd.apache.org/
Trust: 0.3
url:https://httpd.apache.org/security/vulnerabilities_22.html
Trust: 0.3
url:https://httpd.apache.org/security/vulnerabilities_24.html
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=nas8n1022204
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-7668
Trust: 0.3
url:https://issues.jboss.org/):
Trust: 0.2
url:https://access.redhat.com/documentation/en/red-hat-jboss-core-services/
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2017-12613
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2017-12613
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2017-7668
Trust: 0.2
url:https://www.ubuntu.com/usn/usn-3373-1
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-8743
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-7659
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2017-7659
Trust: 0.1
url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.apachehttp&downloadtype=securitypatches&version=2.4.23
Trust: 0.1
sources:
            
            
            BID: 99134 // 
            
            
            
            JVNDB: JVNDB-2017-005024 // 
            
            
            
            PACKETSTORM: 143561 // 
            
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 143785 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 144969 // 
            
            
            
            NVD: CVE-2017-3169

CREDITS
Red Hat
Trust: 0.6
sources:
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 143785 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 144969

SOURCES
db:VULMONid:CVE-2017-3169
db:BIDid:99134
db:JVNDBid:JVNDB-2017-005024
db:PACKETSTORMid:143561
db:PACKETSTORMid:145457
db:PACKETSTORMid:143785
db:PACKETSTORMid:144960
db:PACKETSTORMid:143766
db:PACKETSTORMid:145455
db:PACKETSTORMid:144969
db:NVDid:CVE-2017-3169

LAST UPDATE DATE
2024-11-11T22:55:04.802000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2017-3169date:2023-11-07T00:00:00
db:BIDid:99134date:2017-08-16T08:10:00
db:JVNDBid:JVNDB-2017-005024date:2017-07-25T00:00:00
db:NVDid:CVE-2017-3169date:2023-11-07T02:44:05.110

SOURCES RELEASE DATE
db:VULMONid:CVE-2017-3169date:2017-06-20T00:00:00
db:BIDid:99134date:2017-06-19T00:00:00
db:JVNDBid:JVNDB-2017-005024date:2017-07-13T00:00:00
db:PACKETSTORMid:143561date:2017-07-31T18:22:22
db:PACKETSTORMid:145457date:2017-12-17T15:29:14
db:PACKETSTORMid:143785date:2017-08-16T23:35:53
db:PACKETSTORMid:144960date:2017-11-13T22:23:00
db:PACKETSTORMid:143766date:2017-08-15T22:24:00
db:PACKETSTORMid:145455date:2017-12-17T15:27:58
db:PACKETSTORMid:144969date:2017-11-14T04:32:14
db:NVDid:CVE-2017-3169date:2017-06-20T01:29:00.360