Sign-up

ID

VAR-201706-0271


CVE

CVE-2017-3169


TITLE

Apache httpd In NULL Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-005024

DESCRIPTION

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Apache httpd Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apache HTTP Server is prone to a denial-of-service vulnerability. Attackers may leverage this issue to cause a denial-of-service condition, denying service to legitimate users. The following versions are vulnerable: Apache HTTP Server 2.2.0 to 2.2.32 Apache HTTP Server 2.4.0 to 2.4.25. ========================================================================== Ubuntu Security Notice USN-3373-1 July 31, 2017 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in Apache HTTP Server. This update adds a new ap_get_basic_auth_components() function for use by third-party modules. (CVE-2017-3169) Javier JimA(c)nez discovered that the Apache HTTP Server incorrectly handled parsing certain requests. (CVE-2017-7679) David Dennerline and RA(c)gis Leroy discovered that the Apache HTTP Server incorrectly handled unusual whitespace when parsing requests, contrary to specifications. This update may introduce compatibility issues with clients that do not strictly follow HTTP protocol specifications. A new configuration option "HttpProtocolOptions Unsafe" can be used to revert to the previous unsafe behaviour in problematic environments. (CVE-2016-8743) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: A apache2.2-binA A A A A A A A A A A A A A A A A A A 2.2.22-1ubuntu1.12 In general, a standard system update will make all the necessary changes. (CVE-2017-7679) * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. (CVE-2017-9798) Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: httpd security update Advisory ID: RHSA-2017:2478-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:2478 Issue date: 2017-08-15 CVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7679 CVE-2017-9788 ===================================================================== 1. Summary: An update for httpd is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 3. Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788) * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167) * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169) * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass 1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference 1463207 - CVE-2017-7679 httpd: mod_mime buffer overread 1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: httpd-2.2.15-60.el6_9.5.src.rpm i386: httpd-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-tools-2.2.15-60.el6_9.5.i686.rpm x86_64: httpd-2.2.15-60.el6_9.5.x86_64.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-tools-2.2.15-60.el6_9.5.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm mod_ssl-2.2.15-60.el6_9.5.i686.rpm noarch: httpd-manual-2.2.15-60.el6_9.5.noarch.rpm x86_64: httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.x86_64.rpm mod_ssl-2.2.15-60.el6_9.5.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: httpd-2.2.15-60.el6_9.5.src.rpm x86_64: httpd-2.2.15-60.el6_9.5.x86_64.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-tools-2.2.15-60.el6_9.5.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): noarch: httpd-manual-2.2.15-60.el6_9.5.noarch.rpm x86_64: httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.x86_64.rpm mod_ssl-2.2.15-60.el6_9.5.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: httpd-2.2.15-60.el6_9.5.src.rpm i386: httpd-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-tools-2.2.15-60.el6_9.5.i686.rpm mod_ssl-2.2.15-60.el6_9.5.i686.rpm noarch: httpd-manual-2.2.15-60.el6_9.5.noarch.rpm ppc64: httpd-2.2.15-60.el6_9.5.ppc64.rpm httpd-debuginfo-2.2.15-60.el6_9.5.ppc.rpm httpd-debuginfo-2.2.15-60.el6_9.5.ppc64.rpm httpd-devel-2.2.15-60.el6_9.5.ppc.rpm httpd-devel-2.2.15-60.el6_9.5.ppc64.rpm httpd-tools-2.2.15-60.el6_9.5.ppc64.rpm mod_ssl-2.2.15-60.el6_9.5.ppc64.rpm s390x: httpd-2.2.15-60.el6_9.5.s390x.rpm httpd-debuginfo-2.2.15-60.el6_9.5.s390.rpm httpd-debuginfo-2.2.15-60.el6_9.5.s390x.rpm httpd-devel-2.2.15-60.el6_9.5.s390.rpm httpd-devel-2.2.15-60.el6_9.5.s390x.rpm httpd-tools-2.2.15-60.el6_9.5.s390x.rpm mod_ssl-2.2.15-60.el6_9.5.s390x.rpm x86_64: httpd-2.2.15-60.el6_9.5.x86_64.rpm httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.x86_64.rpm httpd-tools-2.2.15-60.el6_9.5.x86_64.rpm mod_ssl-2.2.15-60.el6_9.5.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: httpd-2.2.15-60.el6_9.5.src.rpm i386: httpd-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-tools-2.2.15-60.el6_9.5.i686.rpm mod_ssl-2.2.15-60.el6_9.5.i686.rpm noarch: httpd-manual-2.2.15-60.el6_9.5.noarch.rpm x86_64: httpd-2.2.15-60.el6_9.5.x86_64.rpm httpd-debuginfo-2.2.15-60.el6_9.5.i686.rpm httpd-debuginfo-2.2.15-60.el6_9.5.x86_64.rpm httpd-devel-2.2.15-60.el6_9.5.i686.rpm httpd-devel-2.2.15-60.el6_9.5.x86_64.rpm httpd-tools-2.2.15-60.el6_9.5.x86_64.rpm mod_ssl-2.2.15-60.el6_9.5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-3167 https://access.redhat.com/security/cve/CVE-2017-3169 https://access.redhat.com/security/cve/CVE-2017-7679 https://access.redhat.com/security/cve/CVE-2017-9788 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZkzq3XlSAg2UNWIIRAjxIAJ9JoJcSMguc2VTpgJl2P5BGoM2IrACfXd/8 Jxb2g1bdehw6Jjq0qF13AEM= =ZvYI -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es): * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak. JIRA issues fixed (https://issues.jboss.org/): JBCS-402 - Errata for httpd 2.4.23.SP3 RHEL7 7

Trust: 2.52

sources: NVD: CVE-2017-3169 // JVNDB: JVNDB-2017-005024 // BID: 99134 // VULMON: CVE-2017-3169 // PACKETSTORM: 143561 // PACKETSTORM: 145457 // PACKETSTORM: 144960 // PACKETSTORM: 143766 // PACKETSTORM: 145455 // PACKETSTORM: 145456

AFFECTED PRODUCTS

vendor:apachemodel:http serverscope:eqversion:2.4.10

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.16

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.2

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.25

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.20

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.17

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.18

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.12

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.4.23

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.2.15

Trust: 1.6

vendor:apachemodel:http serverscope:eqversion:2.2.32

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.3

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.16

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.18

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.26

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.24

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.22

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.13

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.2

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.21

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.31

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.19

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.30

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.29

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.23

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.12

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.14

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.11

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.20

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.25

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.4.1

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.17

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.27

Trust: 1.0

vendor:apachemodel:http serverscope:eqversion:2.2.0

Trust: 1.0

vendor:apachemodel:httpdscope:eqversion:2.4.26

Trust: 0.8

vendor:necmodel:spoolserver/winspool seriesscope:eqversion:reportfiling ver5.2 ~ 6.2

Trust: 0.8

vendor:apachemodel:httpdscope:eqversion:2.2.33

Trust: 0.8

vendor:apachemodel:httpdscope:ltversion:2.2.x

Trust: 0.8

vendor:apachemodel:httpdscope:ltversion:2.4.x

Trust: 0.8

vendor:ubuntumodel:linuxscope:eqversion:17.04

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:16.10

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:16.04

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:14.04

Trust: 0.3

vendor:redhatmodel:software collections for rhelscope:eqversion:0

Trust: 0.3

vendor:redhatmodel:jboss web serverscope:eqversion:0

Trust: 0.3

vendor:redhatmodel:jboss ewsscope:eqversion:2

Trust: 0.3

vendor:redhatmodel:jboss eapscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:jboss core servicesscope:eqversion:1

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc node optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5.0

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.1

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.3

Trust: 0.3

vendor:ibmmodel:iscope:eqversion:7.2

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:6

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.25

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.23

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.20

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.19

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.18

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.17

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.16

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.14

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.12

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.11

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.4

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.26

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.25

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.24

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.23

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.15

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.14

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.13

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.12

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.11

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.10

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.3

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.3

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.24

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.2

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.13

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.1

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.4.0

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.32

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.29

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.22

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.21

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.20

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.19

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.18

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.17

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.16

Trust: 0.3

vendor:apachemodel:apachescope:eqversion:2.2.1

Trust: 0.3

vendor:apachemodel:apachescope:neversion:2.4.26

Trust: 0.3

vendor:apachemodel:2.2.33-devscope:neversion: -

Trust: 0.3

sources: BID: 99134 // JVNDB: JVNDB-2017-005024 // CNNVD: CNNVD-201706-788 // NVD: CVE-2017-3169

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-3169
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-3169
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201706-788
value: CRITICAL

Trust: 0.6

VULMON: CVE-2017-3169
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-3169
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2017-3169
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULMON: CVE-2017-3169 // JVNDB: JVNDB-2017-005024 // CNNVD: CNNVD-201706-788 // NVD: CVE-2017-3169

PROBLEMTYPE DATA

problemtype:CWE-476

Trust: 1.8

sources: JVNDB: JVNDB-2017-005024 // NVD: CVE-2017-3169

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 144960 // PACKETSTORM: 143766 // CNNVD: CNNVD-201706-788

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201706-788

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005024

PATCH
title:NV17-014url:http://jpn.nec.com/security-info/secinfo/nv17-014.html
Trust: 0.8
title:CVE-2017-3169: mod_ssl null pointer dereferenceurl:https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E
Trust: 0.8
title:Apache httpd Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71072
Trust: 0.6
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173476 - Security Advisory
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173477 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173195 - Security Advisory
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173475 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173193 - Security Advisory
Trust: 0.1
title:Red Hat: Important: httpd security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20173194 - Security Advisory
Trust: 0.1
title:Red Hat: CVE-2017-3169url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2017-3169
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2017-3169
Trust: 0.1
title:Ubuntu Security Notice: apache2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3340-1
Trust: 0.1
title:Ubuntu Security Notice: apache2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3373-1
Trust: 0.1
title:Debian Security Advisories: DSA-3896-1 apache2 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=a100e91e6529637522c4f74492953f8c
Trust: 0.1
title:Amazon Linux AMI: ALAS-2017-892url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-892
Trust: 0.1
title:Arch Linux Advisories: [ASA-201706-34] apache: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201706-34
Trust: 0.1
title:Amazon Linux AMI: ALAS-2017-863url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-863
Trust: 0.1
title:Symantec Security Advisories: SA154: Apache httpd Vulnerabilities June 2017url:https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=6f891c1513dfb5c26769ed38bcac6e4f
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a22ad41e97bbfc5abb0bb927bf43089c
Trust: 0.1
title:Tenable Security Advisories: [R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2019-09
Trust: 0.1
title:Oracle Linux Bulletins: Oracle Linux Bulletin - July 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=549dc795290b298746065b62b4bb7928
Trust: 0.1
title:Oracle: Oracle Critical Patch Update Advisory - October 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=523d3f220a64ff01dd95e064bd37566a
Trust: 0.1
title:GyoiThonurl:https://github.com/gyoisamurai/GyoiThon 
Trust: 0.1
title:nrichurl:https://github.com/retr0-13/nrich 
Trust: 0.1
title: - url:https://github.com/RoseSecurity-Research/Red-Teaming-TTPs 
Trust: 0.1
title:Red-Teaming-TTPsurl:https://github.com/RoseSecurity/Red-Teaming-TTPs 
Trust: 0.1
title:Shodan-nrichurl:https://github.com/PawanKumarPandit/Shodan-nrich 
Trust: 0.1
title:DC-3-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-3-Vulnhub-Walkthrough 
Trust: 0.1
title:DC-2-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-2-Vulnhub-Walkthrough 
Trust: 0.1
title:DC-1-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-1-Vulnhub-Walkthrough 
Trust: 0.1
title: - url:https://github.com/hrbrmstr/internetdb 
Trust: 0.1
title: - url:https://github.com/SecureAxom/strike 
Trust: 0.1
title:pigaturl:https://github.com/syadg123/pigat 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-3169 // 
            
            
            
            JVNDB: JVNDB-2017-005024 // 
            
            
            
            CNNVD: CNNVD-201706-788

EXTERNAL IDS
db:NVDid:CVE-2017-3169
Trust: 3.4
db:BIDid:99134
Trust: 1.9
db:TENABLEid:TNS-2019-09
Trust: 1.6
db:SECTRACKid:1038711
Trust: 1.6
db:JVNid:JVNVU98416507
Trust: 0.8
db:JVNDBid:JVNDB-2017-005024
Trust: 0.8
db:CNNVDid:CNNVD-201706-788
Trust: 0.6
db:VULMONid:CVE-2017-3169
Trust: 0.1
db:PACKETSTORMid:143561
Trust: 0.1
db:PACKETSTORMid:145457
Trust: 0.1
db:PACKETSTORMid:144960
Trust: 0.1
db:PACKETSTORMid:143766
Trust: 0.1
db:PACKETSTORMid:145455
Trust: 0.1
db:PACKETSTORMid:145456
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-3169 // 
            
            
            
            BID: 99134 // 
            
            
            
            JVNDB: JVNDB-2017-005024 // 
            
            
            
            PACKETSTORM: 143561 // 
            
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 145456 // 
            
            
            
            CNNVD: CNNVD-201706-788 // 
            
            
            
            NVD: CVE-2017-3169

REFERENCES
url:https://access.redhat.com/errata/rhsa-2017:3477
Trust: 1.7
url:https://access.redhat.com/errata/rhsa-2017:3193
Trust: 1.7
url:https://access.redhat.com/errata/rhsa-2017:2478
Trust: 1.7
url:https://access.redhat.com/errata/rhsa-2017:3475
Trust: 1.7
url:https://access.redhat.com/errata/rhsa-2017:3476
Trust: 1.7
url:https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbux03908en_us
Trust: 1.6
url:https://security.gentoo.org/glsa/201710-32
Trust: 1.6
url:https://support.apple.com/ht208221
Trust: 1.6
url:https://security.netapp.com/advisory/ntap-20180601-0002/
Trust: 1.6
url:http://www.debian.org/security/2017/dsa-3896
Trust: 1.6
url:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Trust: 1.6
url:http://www.securitytracker.com/id/1038711
Trust: 1.6
url:http://www.securityfocus.com/bid/99134
Trust: 1.6
url:https://access.redhat.com/errata/rhsa-2017:2479
Trust: 1.6
url:https://github.com/gottburgm/exploits/tree/master/cve-2017-3169
Trust: 1.6
url:https://www.nomachine.com/su08o00185
Trust: 1.6
url:https://www.tenable.com/security/tns-2019-09
Trust: 1.6
url:https://access.redhat.com/errata/rhsa-2017:3194
Trust: 1.6
url:https://access.redhat.com/errata/rhsa-2017:3195
Trust: 1.6
url:https://access.redhat.com/errata/rhsa-2017:2483
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2017-3169
Trust: 1.4
url:https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3cdev.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3ccvs.httpd.apache.org%3e
Trust: 1.0
url:https://access.redhat.com/security/cve/cve-2017-3169
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3169
Trust: 0.8
url:https://jvn.jp/vu/jvnvu98416507/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-3167
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2017-7679
Trust: 0.6
url:httpd.apache.org%3e
Trust: 0.6
url:https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3cdev.
Trust: 0.6
url:https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs.
Trust: 0.6
url:https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs.
Trust: 0.6
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2017-7679
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2017-3167
Trust: 0.5
url:https://access.redhat.com/security/team/contact/
Trust: 0.5
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.5
url:https://bugzilla.redhat.com/):
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2017-9798
Trust: 0.4
url:https://access.redhat.com/articles/11258
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2017-9798
Trust: 0.4
url:https://access.redhat.com/security/team/key/
Trust: 0.4
url:http://www.apache.org/
Trust: 0.3
url:https://httpd.apache.org/
Trust: 0.3
url:https://httpd.apache.org/security/vulnerabilities_22.html
Trust: 0.3
url:https://httpd.apache.org/security/vulnerabilities_24.html
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=nas8n1022204
Trust: 0.3
url:https://issues.jboss.org/):
Trust: 0.3
url:https://access.redhat.com/documentation/en/red-hat-jboss-core-services/
Trust: 0.3
url:https://access.redhat.com/security/cve/cve-2017-12613
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-12613
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-7668
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2017-9788
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2017-9788
Trust: 0.2
url:https://www.ubuntu.com/usn/usn-3373-1
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-8743
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2017-7668
Trust: 0.1
url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.apachehttp&downloadtype=securitypatches&version=2.4.23
Trust: 0.1
sources:
            
            
            BID: 99134 // 
            
            
            
            JVNDB: JVNDB-2017-005024 // 
            
            
            
            PACKETSTORM: 143561 // 
            
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 145456 // 
            
            
            
            CNNVD: CNNVD-201706-788 // 
            
            
            
            NVD: CVE-2017-3169

CREDITS
Red Hat
Trust: 0.5
sources:
            
            
            PACKETSTORM: 145457 // 
            
            
            
            PACKETSTORM: 144960 // 
            
            
            
            PACKETSTORM: 143766 // 
            
            
            
            PACKETSTORM: 145455 // 
            
            
            
            PACKETSTORM: 145456

SOURCES
db:VULMONid:CVE-2017-3169
db:BIDid:99134
db:JVNDBid:JVNDB-2017-005024
db:PACKETSTORMid:143561
db:PACKETSTORMid:145457
db:PACKETSTORMid:144960
db:PACKETSTORMid:143766
db:PACKETSTORMid:145455
db:PACKETSTORMid:145456
db:CNNVDid:CNNVD-201706-788
db:NVDid:CVE-2017-3169

LAST UPDATE DATE
2024-09-18T22:54:25.661000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2017-3169date:2023-11-07T00:00:00
db:BIDid:99134date:2017-08-16T08:10:00
db:JVNDBid:JVNDB-2017-005024date:2017-07-25T00:00:00
db:CNNVDid:CNNVD-201706-788date:2021-06-07T00:00:00
db:NVDid:CVE-2017-3169date:2023-11-07T02:44:05.110

SOURCES RELEASE DATE
db:VULMONid:CVE-2017-3169date:2017-06-20T00:00:00
db:BIDid:99134date:2017-06-19T00:00:00
db:JVNDBid:JVNDB-2017-005024date:2017-07-13T00:00:00
db:PACKETSTORMid:143561date:2017-07-31T18:22:22
db:PACKETSTORMid:145457date:2017-12-17T15:29:14
db:PACKETSTORMid:144960date:2017-11-13T22:23:00
db:PACKETSTORMid:143766date:2017-08-15T22:24:00
db:PACKETSTORMid:145455date:2017-12-17T15:27:58
db:PACKETSTORMid:145456date:2017-12-17T15:28:41
db:CNNVDid:CNNVD-201706-788date:2017-06-20T00:00:00
db:NVDid:CVE-2017-3169date:2017-06-20T01:29:00.360