Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

CVE-2017-15710

Disclosure Date: March 26, 2018
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user’s credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, ‘en-US’ is truncated to ‘en’). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Vendors

  • apache,
  • canonical,
  • debian,
  • netapp,
  • redhat

Products

  • clustered data ontap -,
  • debian linux 7.0,
  • debian linux 8.0,
  • debian linux 9.0,
  • enterprise linux 6.0,
  • enterprise linux 7.0,
  • enterprise linux 7.4,
  • enterprise linux 7.5,
  • enterprise linux 7.6,
  • http server 2.4.1,
  • http server 2.4.10,
  • http server 2.4.12,
  • http server 2.4.16,
  • http server 2.4.17,
  • http server 2.4.18,
  • http server 2.4.2,
  • http server 2.4.20,
  • http server 2.4.23,
  • http server 2.4.25,
  • http server 2.4.26,
  • http server 2.4.27,
  • http server 2.4.28,
  • http server 2.4.29,
  • http server 2.4.3,
  • http server 2.4.4,
  • http server 2.4.6,
  • http server 2.4.7,
  • http server 2.4.9,
  • santricity cloud connector -,
  • storage automation store -,
  • storagegrid -,
  • ubuntu linux 12.04,
  • ubuntu linux 14.04,
  • ubuntu linux 16.04,
  • ubuntu linux 17.10,
  • ubuntu linux 18.04

References

Advisory

Additional Info

Technical Analysis