CVE-2017-15710

{"id": "CVE-2017-15710", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-03-26T15:29:00.227", "references": [{"url": "http://www.openwall.com/lists/oss-security/2018/03/24/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "http://www.securityfocus.com/bid/103512", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@apache.org"}, {"url": "http://www.securitytracker.com/id/1040569", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@apache.org"}, {"url": "https://access.redhat.com/errata/RHSA-2018:3558", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://access.redhat.com/errata/RHSA-2019:0366", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://access.redhat.com/errata/RHSA-2019:0367", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://httpd.apache.org/security/vulnerabilities_24.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20180601-0004/", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://usn.ubuntu.com/3627-1/", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://usn.ubuntu.com/3627-2/", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://usn.ubuntu.com/3937-2/", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.debian.org/security/2018/dsa-4164", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.tenable.com/security/tns-2019-09", "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all."}, {"lang": "es", "value": "Si mod_authnz_ldap se configura con AuthLDAPCharsetConfig, en las versiones 2.0.23 hasta la 2.0.65, versiones 2.2.0 hasta la 2.2.34 y versiones 2.4.0 hasta la 2.4.29 en Apache httpd, usa el valor de cabecera Accept-Language para buscar la codificaci\u00f3n de charset adecuado cuando se verifican las credenciales de usuario. Si el valor de la cabecera no est\u00e1 presente en la tabla de conversi\u00f3n de charset, se utiliza un mecanismo alternativo para truncarlo en un valor de dos caracteres para permitir que se efect\u00fae un quick retry (por ejemplo, 'en-US' se trunca a 'en'). Un valor de cabecera inferior a dos caracteres fuerza una lectura fuera de l\u00edmites de un byte NULL a una ubicaci\u00f3n de memoria que no forma parte de la cadena. En el peor de los casos, aunque poco probable, el proceso se bloquear\u00eda, lo que se podr\u00eda utilizar como un ataque denegaci\u00f3n de servicio (DoS). Es mucho m\u00e1s probable que esta memoria ya est\u00e9 reservada para su uso futuro y que el problema no tenga ning\u00fan tipo de impacto."}], "lastModified": "2023-11-07T02:40:21.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FCD3C8C-9BF8-4F30-981A-593EEAEB9EDD"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "046487A3-752B-4D0F-8984-96486B828EAB"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89D2E052-51CD-4B57-A8B8-FAE51988D654"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAA27058-BACF-4F94-8E3C-7D38EC302EC1"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FEAB0DF-04A9-4F99-8666-0BADC5D642B8"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7D924D1-8A36-4C43-9E56-52814F9A6350"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39CDFECC-E26D-47E0-976F-6629040B3764"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3ECBCB1-0675-41F5-857B-438F36925F63"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB6CBFBF-74F6-42AF-BC79-AA53EA75F00B"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8717A96B-9DB5-48D6-A2CF-A5E2B26AF3F3"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1F45B27-504B-4202-87B8-BD3B094003F1"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2FB2B98-DFD2-420A-8A7F-9B288651242F"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B803D25B-0A19-4569-BA05-09D58F33917C"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8510442C-212F-4013-85FA-E0AB59F6F2C6"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB5673AB-53BB-40B2-83A7-8B82B2D0EBB8"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBB3ED63-45CA-44AB-973C-9AD2569AD800"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF30AD98-9CBA-456E-A827-79FCEDEB30A1"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.28:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C117BF2F-1E5B-4AEC-8770-3153E5B4CD07"}, {"criteria": "cpe:2.3:a:apache:http_server:2.4.29:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "437BC6D8-D103-452C-9C86-D89FC977A50F"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "8D305F7A-D159-4716-AB26-5E38BB5CD991"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB15BCF1-1B1D-49D8-9B76-46DCB10044DB"}, {"criteria": "cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B7A6697-98CC-4E36-93DB-B7160F8399F9"}, {"criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40"}, {"criteria": "cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FED6CAE-D97F-49E0-9D00-1642A3A427B4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "041F9200-4C01-4187-AE34-240E8277B54D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EB48767-F095-444F-9E05-D9AC345AB803"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F6FA12B-504C-4DBF-A32E-0548557AA2ED"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}