CVE-2017-9798: Use After Free
A use-after free vulnerability was found in apache httpd. There's an apache configuration directive <Limit> that can be used to restrict access to certain HTTP methods. If one sets this inside an .htaccess file with an HTTP method that's not registered in the server the bug happens (e.g. set <Limit INVALID></Limit> in .htaccess). The reason is that at that point the variables used to build up the "Allow" header have already been freed, as it's not expecting any more changes to it.
Note that the bug only appears with OPTIONS requests to a specific path, not with "" OPTIONS requests.
An attacker on a shared hosting could could deliberately create an .htaccess file triggering the bug and subsequently try to exfiltrate data pieces from the global apache process that may contain secrets like password hashes.
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1807754
Other sources
A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash.
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the aplimitsection function in server/core.c.
apache. Multiple issues were addressed by updating to version 2.4.28.
Credit
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-13887
- CVE-2017-9798
- CVE-2017-13905
- CVE-2017-7172
- CVE-2017-13892
- CVE-2017-7171
- CVE-2017-7151
- CVE-2017-1000254
- CVE-2017-13872
- CVE-2017-15422
- CVE-2017-13883
- CVE-2017-7163
- CVE-2017-7155
- CVE-2017-13878
- CVE-2017-13875
- CVE-2017-7159
- CVE-2017-13848
- CVE-2017-13858
- CVE-2017-13847
- CVE-2017-7162
- CVE-2017-13904
- CVE-2017-5754
- CVE-2017-13862
- CVE-2017-13867
- CVE-2017-7173
- CVE-2017-13876
- CVE-2017-13855
- CVE-2017-13865
- CVE-2017-13868
- CVE-2017-13869
- CVE-2017-7154
- CVE-2017-13871
- CVE-2017-13860
- CVE-2017-3735
- CVE-2017-12837
- CVE-2017-7158
- CVE-2017-13911
- CVE-2017-13886
Frequently Asked Questions
What is the severity of CVE-2017-9798?
The severity of CVE-2017-9798 is high with a score of 7.5.
How can an attacker exploit CVE-2017-9798?
An attacker can exploit CVE-2017-9798 by sending a specially crafted request that triggers an information leak from the server's memory.
Which versions of Apache httpd are affected by CVE-2017-9798?
The Apache HTTP Server versions through 2.2.34 and 2.4.x through 2.4.27 are affected by CVE-2017-9798.
What is Optionsbleed?
Optionsbleed is a vulnerability in Apache httpd that allows remote attackers to read secret data from process memory.
How can I mitigate CVE-2017-9798?
To mitigate CVE-2017-9798, update Apache httpd to version 2.4.28 or apply the appropriate patch provided by the vendor.