Published: 20/06/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 447

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server 2.4.25
apache http server 2.2.32
apache http server 2.4.24
netapp storagegrid -
netapp clustered data ontap -
netapp oncommand unified manager -
redhat enterprise linux desktop 7.0
redhat enterprise linux server aus 7.2
redhat enterprise linux workstation 7.0
redhat enterprise linux server tus 7.2
redhat enterprise linux server 7.0
redhat enterprise linux server tus 7.3
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server tus 7.4
redhat enterprise linux eus 7.3
redhat enterprise linux eus 7.4
redhat enterprise linux eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux eus 7.6
redhat enterprise linux eus 7.2
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
redhat enterprise linux eus 7.7
debian debian linux 8.0
debian debian linux 9.0
oracle secure global desktop 5.3
apple mac os x
apple mac os x 10.11.6
apple mac os x 10.12.6

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Topic An update for httpd is now available for Red Hat Enterprise Linux 72 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Topic An update for httpd is now available for Red Hat Enterprise Linux 73 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Several vulnerabilities have been found in the Apache HTTPD server CVE-2017-3167 Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed CVE-2017-3169 Vasileios Panopoulos of AdNovum Informatik AG discovered ...

Several security issues were fixed in Apache HTTP Server ...

ap_find_token() buffer overread:A buffer over-read flaw was found in the httpd's ap_find_token() function A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request (CVE-2017-7668 ) Apache HTTP Request Parsing Whitespace Defects:It was discovered that the HTTP parser in httpd incorrectly allow ...

A buffer over-read flaw was found in the httpd's ap_find_token() function A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request ...

An out-of-bounds read has been found in Apache httpd < 2426 The HTTP strict parsing changes added in 2232 and 2424 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or ...

Tenablesc leverages third-party software to help provide underlying functionality Three separate third-party components (OpenSSL, Apache HTTP Server, SimpleSAMLphp) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bun ...

🦄 A curated list of the awesome resources about the Vulnerability Research

Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own If you are really curious about then you’ll find your own way to discover a flow, this list aimed to h

final project offensive report

offensive final project offensive report Red Team: Summary of Operations Table of Contents Exposed Services Critical Vulnerabilities Exploitation Exposed Services TODO: Fill out the information below Nmap scan results for each machine reveal the below services and OS details: $ nmap nmap -sC -sV --reason -p 22,80,139,445 1921681110

Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own If you are really curious about then you’ll find your own way to discover a flow, this list aimed to h

🦄 A curated list of the awesome resources about the Vulnerability Research

Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own If you are really curious about then you’ll find your own way to discover a flow, this list aimed to h

GyoiThon is a growing penetration test tool using Machine Learning.

GyoiThon: Next generation penetration test tool Japanese page is here Presentation January 25th,2018:JANOG41 March 23th,2018:Black Hat ASIA 2018 Arsenal August 12th,2018:DEFCON26 DemoLabs October 24th,2018:OWS in CSS2018 November 3rd,2018:AV TOKYO 2018 HIVE December 22-23th,2018:SECCON YOROZU 2018 March 28th,2019:Black Hat ASIA 2019 Arsenal Documents Installation Usage T

🦄 A curated list of the awesome resources about the Vulnerability Research

Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own If you are really curious about then you’ll find your own way to discover a flow, this list aimed to h

With added support for OWASP broken websites testing, Also reports are generated.

GyoiThon: Next generation penetration test tool Check reports on click here Overview GyoiThon is Intelligence Gathering tool for Web Server GyoiThon execute remote access to target Web server and identifies product operated on the server such as CMS, Web server software, Framework, Programming Language etc, And, it can execute exploit modules to identified products using Meta

Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own If you are really curious about then you’ll find your own way to discover a flow, this list aimed to h

SAP's Business Client can own entire apps, DDOS them into dust

The Register • Richard Chirgwin • 11 Apr 2018

And that's the worst of ten patches awaiting lucky, lucky SAP admins

SAP has issued its April security update, which brings a waiting world news of ten patch-worthy problems. The nastiest has a CVSS rating of 9.8 and impacts SAP's Business Client, the desktop tool to access much of its wares. Details of the problem are behind a registration wall, but according to ERP Scan, the vulnerability is a memory corruption bug that allows an attacker to inject crafted code into working memory. The outcome can be "complete control” over the application, denial of service,...

CVE-2017-7668

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect