Vulnerability Details : CVE-2017-9798
Public exploit exists!
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Vulnerability category: Memory Corruption
Threat overview for CVE-2017-9798
Top countries where our scanners detected CVE-2017-9798
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-9798 4,945,337
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-9798!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-9798
Probability of exploitation activity in the next 30 days: 97.31%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2017-9798
-
Apache Optionsbleed Scanner
Disclosure Date: 2017-09-18First seen: 2020-04-26auxiliary/scanner/http/apache_optionsbleedThis module scans for the Apache optionsbleed vulnerability where the Allow response header returned from an OPTIONS request may bleed memory if the server has a .htaccess file with an invalid Limit method defined.
CVSS scores for CVE-2017-9798
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-9798
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-9798
-
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_2
-
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html s
-
https://access.redhat.com/errata/RHSA-2017:3239
RHSA-2017:3239 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_Mailing List;Vendor Advisory
-
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
HPESBUX03909 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote VulnerabilitiesThird Party Advisory
-
http://www.securitytracker.com/id/1039387
Apache HTTPD Use-After-Free Memory Error in Processing HTTP OPTIONS Requests Lets Remote Users Obtain Potentially Sensitive Information on the Target System in Certain Cases - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.tenable.com/security/tns-2019-09
[R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilities - Security Advisory | Tenable®Third Party Advisory
-
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CPU Oct 2018Patch;Third Party Advisory
-
http://openwall.com/lists/oss-security/2017/09/18/2
oss-security - Optionsbleed bug in Apache HTTPDMailing List;VDB Entry
-
https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
Optionsbleed - HTTP OPTIONS method can leak Apache's server memory | The Fuzzing ProjectExploit;Patch;Technical Description;Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Oracle Critical Patch Update - April 2018Patch;Third Party Advisory
-
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
Pony Mail!Mailing List;Vendor Advisory
-
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
Pony Mail!Mailing List;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2017:3240
RHSA-2017:3240 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Oracle Critical Patch Update - January 2018Patch;Third Party Advisory
-
http://www.securityfocus.com/bid/100872
Apache HTTP Server CVE-2017-9798 Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3Ccvs.httpd.apache.org%3E
svn commit: r1888194 [11/13] - /httpd/site/trunk/content/security/json/ - Pony Mail
-
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html s
-
http://www.securityfocus.com/bid/105598
Oracle PeopleSoft Enterprise PeopleTools Multiple Remote Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2017:3113
RHSA-2017:3113 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3194
RHSA-2017:3194 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security-tracker.debian.org/tracker/CVE-2017-9798
CVE-2017-9798Third Party Advisory
-
https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c@%3Ccvs.httpd.apache.org%3E
svn commit: r1073139 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ - Pony Mail
-
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ - Pony Mail
-
https://github.com/hannob/optionsbleed
GitHub - hannob/optionsbleedExploit;Third Party Advisory
-
https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
Exploit;Patch;Technical Description;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3195
RHSA-2017:3195 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
Pony Mail!Mailing List;Vendor Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Oracle Critical Patch Update - April 2019Patch;Third Party Advisory
-
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_Mailing List;Vendor Advisory
-
https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3Ccvs.httpd.apache.org%3E
Pony Mail!
-
https://support.apple.com/HT208331
About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan - Apple SupportThird Party Advisory
-
https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
Vendor Advisory
-
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
Pony Mail!
-
https://access.redhat.com/errata/RHSA-2017:3018
RHSA-2017:3018 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3475
RHSA-2017:3475 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Oracle Critical Patch Update - January 2019Patch;Third Party Advisory
-
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E
svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
-
https://security.netapp.com/advisory/ntap-20180601-0003/
CVE-2017-9798 Apache HTTP Server Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2972
RHSA-2017:2972 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3477
RHSA-2017:3477 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3476
RHSA-2017:3476 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
Pony Mail!Mailing List;Vendor Advisory
-
http://www.debian.org/security/2017/dsa-3980
Debian -- Security Information -- DSA-3980-1 apache2Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CPU July 2018Patch;Third Party Advisory
-
https://security.gentoo.org/glsa/201710-32
Apache: Multiple vulnerabilities (GLSA 201710-32) — Gentoo securityThird Party Advisory
-
https://www.exploit-db.com/exploits/42745/
Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory LeakExploit;Third Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2017:3114
RHSA-2017:3114 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:3193
RHSA-2017:3193 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a
core: Disallow Methods' registration at run time (.htaccess), they ma… · apache/httpd@4cc2782 · GitHubPatch;Vendor Advisory
-
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_Mailing List;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2017:2882
We're sorry, but something went wrong (500)Third Party Advisory
-
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_Mailing List;Vendor Advisory
-
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798
httpd 2.4 vulnerabilities - The Apache HTTP Server ProjectVendor Advisory
Products affected by CVE-2017-9798
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*