usn-3279-1
Vulnerability from osv_ubuntu
Published
2017-05-09 14:16
Modified
2026-04-22 07:36
Summary
apache2 vulnerabilities
Details

It was discovered that the Apache mod_session_crypto module was encrypting data and cookies using either CBC or ECB modes. A remote attacker could possibly use this issue to perform padding oracle attacks. (CVE-2016-0736)

Maksim Malyutin discovered that the Apache mod_auth_digest module incorrectly handled malicious input. A remote attacker could possibly use this issue to cause Apache to crash, resulting in a denial of service. (CVE-2016-2161)

David Dennerline and Régis Leroy discovered that the Apache HTTP Server incorrectly handled unusual whitespace when parsing requests, contrary to specifications. When being used in combination with a proxy or backend server, a remote attacker could possibly use this issue to perform an injection attack and pollute cache. This update may introduce compatibility issues with clients that do not strictly follow HTTP protocol specifications. A new configuration option "HttpProtocolOptions Unsafe" can be used to revert to the previous unsafe behaviour in problematic environments. (CVE-2016-8743)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-0736",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2161",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8743",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-mpm-event",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-mpm-itk",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-mpm-prefork",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-mpm-worker",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-suexec",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "apache2.2-bin",
            "binary_version": "2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "libapache2-mod-macro",
            "binary_version": "1:2.4.7-1ubuntu4.15"
          },
          {
            "binary_name": "libapache2-mod-proxy-html",
            "binary_version": "1:2.4.7-1ubuntu4.15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.7-1ubuntu4.15?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-1ubuntu4.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.6-2ubuntu2",
        "2.4.6-2ubuntu3",
        "2.4.6-2ubuntu4",
        "2.4.7-1ubuntu1",
        "2.4.7-1ubuntu2",
        "2.4.7-1ubuntu3",
        "2.4.7-1ubuntu4",
        "2.4.7-1ubuntu4.1",
        "2.4.7-1ubuntu4.4",
        "2.4.7-1ubuntu4.5",
        "2.4.7-1ubuntu4.6",
        "2.4.7-1ubuntu4.7",
        "2.4.7-1ubuntu4.8",
        "2.4.7-1ubuntu4.9",
        "2.4.7-1ubuntu4.10",
        "2.4.7-1ubuntu4.11",
        "2.4.7-1ubuntu4.13"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-0736",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2161",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8743",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.18-2ubuntu3.2"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.18-2ubuntu3.2"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.18-2ubuntu3.2"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.18-2ubuntu3.2"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.18-2ubuntu3.2"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.18-2ubuntu3.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.18-2ubuntu3.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.18-2ubuntu3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.12-2ubuntu2",
        "2.4.17-1ubuntu1",
        "2.4.17-2ubuntu1",
        "2.4.17-3ubuntu1",
        "2.4.18-1ubuntu1",
        "2.4.18-2ubuntu1",
        "2.4.18-2ubuntu2",
        "2.4.18-2ubuntu3",
        "2.4.18-2ubuntu3.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the Apache mod_session_crypto module was encrypting\ndata and cookies using either CBC or ECB modes. A remote attacker could\npossibly use this issue to perform padding oracle attacks. (CVE-2016-0736)\n\nMaksim Malyutin discovered that the Apache mod_auth_digest module\nincorrectly handled malicious input. A remote attacker could possibly use\nthis issue to cause Apache to crash, resulting in a denial of service.\n(CVE-2016-2161)\n\nDavid Dennerline and R\u00e9gis Leroy discovered that the Apache HTTP Server\nincorrectly handled unusual whitespace when parsing requests, contrary to\nspecifications. When being used in combination with a proxy or backend\nserver, a remote attacker could possibly use this issue to perform an\ninjection attack and pollute cache. This update may introduce compatibility\nissues with clients that do not strictly follow HTTP protocol\nspecifications. A new configuration option \"HttpProtocolOptions Unsafe\" can\nbe used to revert to the previous unsafe behaviour in problematic\nenvironments. (CVE-2016-8743)\n",
  "id": "USN-3279-1",
  "modified": "2026-04-22T07:36:34Z",
  "published": "2017-05-09T14:16:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3279-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-0736"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2161"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8743"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "apache2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-0736",
    "UBUNTU-CVE-2016-2161",
    "UBUNTU-CVE-2016-8743"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.