Denial of Service Vulnerability in Apache2 due to Improper Charset Handling
Summary
ALPINE-CVE-2017-15710: In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying... Affects apache2 versions < 2.4.33-r0. Fixed in 2.4.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely-used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, power, and extensive module support, allowing users to customize their server environment. However, certain configurations can expose Apache2 to vulnerabilities, such as the one identified in CVE-2017-15710, which affects versions 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29. This vulnerability arises from the improper handling of the Accept-Language header in the mod_authnz_ldap module, potentially leading to a Denial of Service (DoS) attack.
Vulnerability Detail
In Apache HTTP Server versions 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, the mod_authnz_ldap module uses the Accept-Language header to determine the appropriate charset encoding for user credentials. If the header value is not found in the charset conversion table, it truncates the value to two characters for a quick retry. This can lead to an out-of-bounds write when the header value is less than two characters, potentially causing a crash or a Denial of Service. The severity of this vulnerability is rated at CVSS 3.0 score of 7.5, indicating a high risk.
How To Fix
Minimum fixed version
2.4.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the mod_authnz_ldap module if it is not essential for your application. This can be done by commenting out the relevant LoadModule directive in your Apache configuration file.
Conclusion
The CVE-2017-15710 vulnerability in Apache2 poses a significant risk due to improper handling of the Accept-Language header, potentially leading to Denial of Service attacks. It is crucial to update to the patched version 2.4.33-r0 or disable the affected module to mitigate risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2017-15710 is a vulnerability in Apache HTTP Server that can lead to a Denial of Service due to improper handling of the Accept-Language header in the mod_authnz_ldap module.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause a Denial of Service, which may lead to application downtime and affect user access to the web services hosted on the Apache server.
Yes, the patched version of Apache2 for Alpine Linux is 2.4.33-r0. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, consider disabling the mod_authnz_ldap module as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
