Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2017-7668

Опубликовано: 20 июн. 2017
Источник: redhat
CVSS3: 6.5
EPSS Средний

Описание

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 5httpdNot affected
Red Hat Enterprise Linux 6httpdNot affected
Red Hat JBoss Core ServiceshttpdNot affected
Red Hat JBoss Enterprise Application Platform 5jbossasNot affected
Red Hat JBoss Enterprise Application Platform 6jbossasNot affected
Red Hat JBoss Enterprise Web Server 1httpdNot affected
Red Hat JBoss Enterprise Web Server 2httpdNot affected
Red Hat JBoss Enterprise Web Server 3httpdNot affected
Red Hat Enterprise Linux 7httpdFixedRHSA-2017:247915.08.2017
Red Hat Enterprise Linux 7.2 Extended Update SupporthttpdFixedRHSA-2017:319313.11.2017

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-122
https://bugzilla.redhat.com/show_bug.cgi?id=1463205httpd: ap_find_token() buffer overread

EPSS

Процентиль: 99%
0.6942
Средний

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 8 лет назад

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

CVSS3: 7.5
nvd
больше 8 лет назад

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

CVSS3: 7.5
debian
больше 8 лет назад

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.2 ...

CVSS3: 7.5
github
больше 3 лет назад

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

CVSS3: 9.8
fstec
больше 8 лет назад

Уязвимость функции ap_find_token веб-сервера Apache HTTP Server, позволяющая нарушителю вызвать ошибку сегментации

EPSS

Процентиль: 99%
0.6942
Средний

6.5 Medium

CVSS3

Уязвимость CVE-2017-7668