vendor:
HTTP Server
by:
Hanno Böck
7,5
CVSS
HIGH
Optionsbleed
20
CWE
Product Name: HTTP Server
Affected Version From: 2.2.34
Affected Version To: 2.4.27
Patch Exists: YES
Related CWE: CVE-2017-9798
CPE: a:apache:http_server
Metasploit:
https://www.rapid7.com/db/vulnerabilities/debian-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/hpux-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp1-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/ibm-http_server-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/apple-osx-apache-cve-2017-9798/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2017-9798/
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2017
Optionsbleed proof of concept test
Optionsbleed is a vulnerability in Apache web servers that allows attackers to leak memory from the server. It is caused by a bug in the handling of the Allow header in the HTTP OPTIONS request. The vulnerability was discovered in 2017 and affects Apache versions 2.2.34 and 2.4.27 and later.
Mitigation:
Upgrade to Apache version 2.2.34 or 2.4.27 or later.