Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability

Bugtraq ID:	99569
Class:	Design Error
CVE:	CVE-2017-9788
Remote:	Yes
Local:	No
Published:	Jul 11 2017 12:00AM
Updated:	Aug 16 2017 08:10AM
Credit:	Robert Swiecki
Vulnerable:	Ubuntu Ubuntu Linux 17.04 Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 CentOS CentOS 6 Apache Apache 2.4.26 Apache Apache 2.4.25 Apache Apache 2.4.23 Apache Apache 2.4.20 Apache Apache 2.4.19 Apache Apache 2.4.18 Apache Apache 2.4.17 Apache Apache 2.4.16 Apache Apache 2.4.14 Apache Apache 2.4.12 Apache Apache 2.4.11 Apache Apache 2.4.10 Apache Apache 2.4.5 Apache Apache 2.4.4 Apache Apache 2.2.33 Apache Apache 2.2.26 Apache Apache 2.2.25 Apache Apache 2.2.24 Apache Apache 2.2.23 Apache Apache 2.2.15 Apache Apache 2.2.14 Apache Apache 2.2.13 Apache Apache 2.2.12 Apache Apache 2.2.11 Apache Apache 2.2.10 Apache Apache 2.2.9 + Adobe Flash Media Server 3.5.3 + Adobe Flash Media Server 3.5.2 + Adobe Flash Media Server 3.5.1 Apache Apache 2.2.8 Apache Apache 2.2.6 Apache Apache 2.2.5 Apache Apache 2.2.4 Apache Apache 2.2.3 Apache Apache 2.2.2 Apache Apache 2.2 Apache Apache 2.4.9 Apache Apache 2.4.8 Apache Apache 2.4.7 Apache Apache 2.4.6 Apache Apache 2.4.3 Apache Apache 2.4.24 Apache Apache 2.4.2 Apache Apache 2.4.13 Apache Apache 2.4.1 Apache Apache 2.4.0 Apache Apache 2.2.32 Apache Apache 2.2.29 Apache Apache 2.2.22 Apache Apache 2.2.21 Apache Apache 2.2.20 Apache Apache 2.2.19 Apache Apache 2.2.18 Apache Apache 2.2.17 Apache Apache 2.2.16 Apache Apache 2.2.1
Not Vulnerable:	Apache Apache 2.2.34 Apache Apache 2.4.27

Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability

Apache HTTP Server is prone to a memory-corruption vulnerability.

Attackers can exploit this issue to cause to obtain sensitive information or cause denial-of-service conditions.

Versions prior to Apache httpd 2.2.34 and 2.4.27 are vulnerable.

Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability

References:

• Apache Homepage (Apache)
  
• Apache httpd Homepage (Apache)
  
• CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest (Red Hat)
  
• CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest (William A Rowe Jr)