Vulnerabilities > CVE-2016-1546 - Resource Management Errors vulnerability in Apache Http Server 2.4.17/2.4.18

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
high complexity
apache
CWE-399
nessus
NVD
Published: 2016-07-06
Updated: 2023-11-07

Summary

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

Vulnerable Configurations

Part Description Count
Application
Apache
2

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0013_HTTPD.NASL
    descriptionAn update of the httpd package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121683
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121683
    titlePhoton OS 1.0: Httpd PHSA-2017-0013
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201610-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201610-02 (Apache: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Apache HTTP Server. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could bypass intended access restrictions, conduct HTTP request smuggling attacks, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id93903
    published2016-10-07
    reporterThis script is Copyright (C) 2016-2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93903
    titleGLSA-201610-02 : Apache: Multiple vulnerabilities
  • NASL familyWeb Servers
    NASL idAPACHE_2_4_20.NASL
    descriptionAccording to its banner, the version of Apache running on the remote host is either 2.4.17 or 2.4.18. A denial of service (DoS) vulnerability exists in server threads due to a lengthy thread-block time. An unauthenticated, remote attacker can exploit this issue, to block server threads, and causing the application to stop responding.
    last seen2020-06-01
    modified2020-06-02
    plugin id122059
    published2019-02-08
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122059
    titleApache 2.4.17 / 2.4.18 DoS
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0013.NASL
    descriptionAn update of [cracklib,libevent,libgcrypt,httpd,glibc] packages for PhotonOS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111862
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111862
    titlePhoton OS 1.0: Cracklib / Glibc / Httpd / Libevent / Libgcrypt PHSA-2017-0013 (deprecated)

Redhat

advisories
rhsa
idRHSA-2017:1161
rpms
  • httpd24-httpd-0:2.4.25-9.el6
  • httpd24-httpd-0:2.4.25-9.el7
  • httpd24-httpd-debuginfo-0:2.4.25-9.el6
  • httpd24-httpd-debuginfo-0:2.4.25-9.el7
  • httpd24-httpd-devel-0:2.4.25-9.el6
  • httpd24-httpd-devel-0:2.4.25-9.el7
  • httpd24-httpd-manual-0:2.4.25-9.el6
  • httpd24-httpd-manual-0:2.4.25-9.el7
  • httpd24-httpd-tools-0:2.4.25-9.el6
  • httpd24-httpd-tools-0:2.4.25-9.el7
  • httpd24-mod_ldap-0:2.4.25-9.el6
  • httpd24-mod_ldap-0:2.4.25-9.el7
  • httpd24-mod_proxy_html-1:2.4.25-9.el6
  • httpd24-mod_proxy_html-1:2.4.25-9.el7
  • httpd24-mod_session-0:2.4.25-9.el6
  • httpd24-mod_session-0:2.4.25-9.el7
  • httpd24-mod_ssl-1:2.4.25-9.el6
  • httpd24-mod_ssl-1:2.4.25-9.el7

The Hacker News

idTHN:35D65655AF3E2530CD06D90BAC7FBED8
last seen2018-07-15
modified2018-07-15
published2016-08-03
reporterThe Hacker News
sourcehttps://thehackernews.com/2016/08/http2-protocol-security.html
title4 Flaws hit HTTP/2 Protocol that could allow Hackers to Disrupt Servers

References