Apache httpd mod_mime Buffer Overflow (CVE-2017-7679)
Summary
CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. Affects apache2 across 2 version ranges.
< 2.4.26-r0
>= cd3e5a83cd5765d12b3237631c829eaff80f8425, < 34ae6b5c14599b0a2619ea29709e77f10ab07352
Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache httpd is a widely used open-source web server software. It provides a secure and efficient platform for hosting websites and applications. The mod_mime module in Apache httpd is responsible for handling MIME types and content-type headers. However, a vulnerability (CVE-2017-7679) has been discovered in versions 2.2.x and 2.4.x of Apache httpd that allows an attacker to trigger a buffer overflow in mod_mime when sending a malicious Content-Type response header.
Vulnerability Detail
The vulnerability (CVE-2017-7679) in Apache httpd's mod_mime module occurs due to a boundary error when processing Content-Type response headers. By sending a specially crafted header, an attacker can cause the server to read one byte past the end of a buffer. This can lead to various consequences, including remote code execution, denial of service, or information disclosure. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the mod_mime module. This can be achieved by modifying the Apache httpd configuration file and commenting out or removing the 'LoadModule mime_module' line. However, this workaround may impact the functionality of certain features that rely on mod_mime.
Conclusion
The Apache httpd mod_mime buffer overflow vulnerability (CVE-2017-7679) poses a significant risk to web servers running affected versions. It is crucial to promptly upgrade to the latest version of Apache httpd and apply the necessary patches to mitigate this vulnerability. Regularly monitoring for security updates and following best practices for web server administration is essential to ensure the security and integrity of web applications.
See every vulnerability recorded for apache2 →
FAQ
Apache httpd is an open-source web server software widely used for hosting websites and applications.
The mod_mime module in Apache httpd is responsible for handling MIME types and content-type headers.
The vulnerability (CVE-2017-7679) can allow an attacker to trigger a buffer overflow, potentially leading to remote code execution, denial of service, or information disclosure.
To fix this vulnerability, it is recommended to upgrade to Apache httpd version 2.4.26 or later and apply the provided patches.
Yes, a temporary workaround is to disable the mod_mime module by modifying the Apache httpd configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
