PublicDateAtUSN: 2017-09-18
Candidate: CVE-2017-9798
PublicDate: 2017-09-18 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798
 https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
 https://github.com/hannob/optionsbleed
 https://ubuntu.com/security/notices/USN-3425-1
 https://ubuntu.com/security/notices/USN-3425-2
Description:
 Apache httpd allows remote attackers to read secret data from process
 memory if the Limit directive can be set in a user's .htaccess file, or if
 httpd.conf has certain misconfigurations, aka Optionsbleed. This affects
 the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The
 attacker sends an unauthenticated OPTIONS HTTP request when attempting to
 read secret data. This is a use-after-free issue and thus secret data is
 not always sent, and the specific data depends on many factors including
 configuration. Exploitation with .htaccess can be blocked with a patch to
 the ap_limit_section function in server/core.c.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876109
Priority: medium
Discovered-by: Hanno Böck
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]

Patches_apache2:
 upstream: https://svn.apache.org/viewvc?view=revision&revision=1807754
upstream_apache2: needs-triage
precise/esm_apache2: released (2.2.22-1ubuntu1.14)
trusty_apache2: released (2.4.7-1ubuntu4.18)
trusty/esm_apache2: released (2.4.7-1ubuntu4.18)
vivid/ubuntu-core_apache2: DNE
xenial_apache2: released (2.4.18-2ubuntu3.5)
esm-infra/xenial_apache2: released (2.4.18-2ubuntu3.5)
zesty_apache2: released (2.4.25-3ubuntu2.3)
artful_apache2: released (2.4.27-2ubuntu3)
devel_apache2: released (2.4.27-2ubuntu3)