Input validation error in apache2 (Alpine package)

1) Input validation error

EUVDB-ID: #VU33821

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-3183

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

apache2 (Alpine package): 2.4.4-r0 - 2.4.12-r1

CPE2.3

• cpe:2.3:o:alpine:apache2_alpine_package:2.4.4-r0:*:*:*:*:alpine_linux:*:2.4
• cpe:2.3:o:alpine:apache2_alpine_package:2.4.4-r1:*:*:*:*:alpine_linux:*:2.4
• cpe:2.3:o:alpine:apache2_alpine_package:2.4.6-r0:*:*:*:*:alpine_linux:*:2.4

External links

https://git.alpinelinux.org/aports/commit/?id=db992fcd384a88b087cf614ea6085a7618361f3a
https://git.alpinelinux.org/aports/commit/?id=7a5b508efbcc2243c09bd0b060136f78409d3ab7
https://git.alpinelinux.org/aports/commit/?id=b1db34556bafee5506f78b45c1a6f88844d89508
https://git.alpinelinux.org/aports/commit/?id=b785b5f3aa75162cd033fd8dc922f4e2a5fd770e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.