CVE-2017-9798 Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbl...
HighCVSS 7.5
EPSS 94.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | < 2.4.27-6 | 2.4.27-6 |
| debian/apache2(Debian:13) | < 2.4.27-6 | 2.4.27-6 |
| debian/apache2(Debian:14) | < 2.4.27-6 | 2.4.27-6 |
| Apache HTTP Server | <= 2.2.34 | No fix listed |
| Apache HTTP Server | = 2.4.0 | No fix listed |
| Apache HTTP Server | = 2.4.1 | No fix listed |
| Apache HTTP Server | = 2.4.2 | No fix listed |
| Apache HTTP Server | = 2.4.3 | No fix listed |
| Apache HTTP Server | = 2.4.4 | No fix listed |
| Apache HTTP Server | = 2.4.6 | No fix listed |
| Apache HTTP Server | = 2.4.7 | No fix listed |
| Apache HTTP Server | = 2.4.9 | No fix listed |
| Apache HTTP Server | = 2.4.10 | No fix listed |
| Apache HTTP Server | = 2.4.12 | No fix listed |
| Apache HTTP Server | = 2.4.16 | No fix listed |
| Apache HTTP Server | = 2.4.17 | No fix listed |
| Apache HTTP Server | = 2.4.18 | No fix listed |
| Apache HTTP Server | = 2.4.20 | No fix listed |
| Apache HTTP Server | = 2.4.23 | No fix listed |
| Apache HTTP Server | = 2.4.25 | No fix listed |
| Apache HTTP Server | = 2.4.26 | No fix listed |
| Apache HTTP Server | = 2.4.27 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/apache2(Alpine:v3.10) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.11) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.12) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.13) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.14) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.15) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.16) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.17) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.18) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.19) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.20) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.21) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.22) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.23) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.24) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.3) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.4) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.5) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.6) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.7) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.8) | < 2.4.27-r1 | 2.4.27-r1 |
| alpine/apache2(Alpine:v3.9) | < 2.4.27-r1 | 2.4.27-r1 |
| Apache HTTP Server | = Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27 | No fix listed |
References
- Debian Security Tracker CVE-2017-9798 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking
- openwall.com mailing-list vdb-entry
- DSA-3980 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 100872 third-party-advisory vdb-entry
- 105598 third-party-advisory vdb-entry
- 1039387 third-party-advisory vdb-entry
- RHSA-2017:2882 third-party-advisory vendor-advisory
- RHSA-2017:2972 third-party-advisory vendor-advisory
- RHSA-2017:3018 third-party-advisory vendor-advisory
- RHSA-2017:3113 third-party-advisory vendor-advisory
- RHSA-2017:3114 third-party-advisory vendor-advisory
- RHSA-2017:3193 third-party-advisory vendor-advisory
- RHSA-2017:3194 third-party-advisory vendor-advisory
- RHSA-2017:3195 third-party-advisory vendor-advisory
- RHSA-2017:3239 third-party-advisory vendor-advisory
- RHSA-2017:3240 third-party-advisory vendor-advisory
- RHSA-2017:3475 third-party-advisory vendor-advisory
- RHSA-2017:3476 third-party-advisory vendor-advisory
- RHSA-2017:3477 third-party-advisory vendor-advisory
- blog.fuzzing-project.org exploit patch technical-description third-party-advisory
- blog.fuzzing-project.org exploit patch technical-description third-party-advisory
- github.com patch vendor-advisory
- github.com exploit third-party-advisory
- httpd.apache.org vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [11/13] - /httpd/site/trunk/content/security/json/ mailing-list
- GLSA-201710-32 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- support.apple.com third-party-advisory
- support.hpe.com third-party-advisory
- svn.apache.org vendor-advisory
- 42745 exploit third-party-advisory vdb-entry
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.tenable.com third-party-advisory
- seclists.org
- security.alpinelinux.org vendor-advisory