#VU1800 Padding oracle attack in Apache HTTP Server - CVE-2016-0736

Vulnerability identifier: #VU1800

Vulnerability risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2016-0736

CWE-ID: CWE-696

Exploitation vector: Local network

Exploit availability: Yes

Vulnerable software:
Apache HTTP Server
Server applications / Web servers

Vendor: Apache Foundation

Description
The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in Apache mod_session_crypto implementation. A remote attacker with ability to intercept traffic can decipher potentially sensitive information or tamper with data.

Successful exploitation may allow an attacker to perform padding oracle attack against vulnerable web server and obtain potentially sensitive information.

Mitigation
The vulnerability is fixed in Apache HTTP Server 2.4.25.

Vulnerable software versions

Apache HTTP Server: 2.4.1 - 2.4.23

---

External links
https://httpd.apache.org/security/vulnerabilities_24.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.