Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-7668 |
CWE-ID | CWE-125 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software |
apache2 (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU7117
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-7668
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing token lists within ap_find_token() function. A remote unauthenticated attacker can create a specially crafted sequence of HTTP headers and refer to data past the end of the search string.
Successful exploitation of this vulnerability results segmentation fault and web server crash.
MitigationInstall update from vendor's website.
Vulnerable software versionsapache2 (Alpine package): 2.4.25-r0 - 2.4.25-r1
CPE2.3https://git.alpinelinux.org/aports/commit/?id=33c9b879e1ac2712ea308a9c9e642d83b54d690d
https://git.alpinelinux.org/aports/commit/?id=123bd575ef649725247a39822c96929fc1d5e06b
https://git.alpinelinux.org/aports/commit/?id=a565b281e6104e1e1f7ec2b18e1e43353c71a483
https://git.alpinelinux.org/aports/commit/?id=c930c29f44d1c8c27a01acc3e871b48922d3b620
https://git.alpinelinux.org/aports/commit/?id=f0f780e35d42ebf1bbacad2015da18bf1c42dc74
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.