Date: Fri, 23 Mar 2018 21:49:59 -0500 From: Daniel Ruggeri <druggeri@...che.org> To: announce@...pd.apache.org, oss-security@...ts.openwall.com, security@...pd.apache.org Subject: CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values. Severity: Low Vendor: The Apache Software Foundation Versions Affected: httpd 2.0.23 to 2.0.65 httpd 2.2.0 to 2.2.34 httpd 2.4.0 to 2.4.29 Description: mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all." Mitigation: All httpd users should upgrade to 2.4.30 or later. Users of (the now end-of-life) httpd 2.2 who cannot upgrade at this time should apply CVE-2017-15710.patch, which is available at https://www.apache.org/dist/httpd/patches/apply_to_2.2.34/ Credit: The Apache HTTP Server security team would like to thank Alex Nichols and Jakob Hirsch for reporting this issue. References: https://httpd.apache.org/security/vulnerabilities_24.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.