CVE-2019-10097 - 漏洞详情

CVE-2019-10097 (CNNVD-201908-1141)

HIGH

中文标题:

Apache HTTP Server 代码问题漏洞

英文标题:

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary ...

CVSS分数: 7.2

发布时间: 2019-09-26 14:21:24

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Apache HTTP Server是美国阿帕奇软件（Apache Software）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.32版本至2.4.39版本中存在代码问题漏洞。远程攻击者通过发送特制PROXY标头利用该漏洞导致拒绝服务。

英文描述:

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CWE类型:

CWE-476 CWE-787

受影响产品

厂商	产品	版本	版本范围	平台	CPE
apache	http_server	2.4.33	-	-	`cpe:2.3:a:apache:http_server:2.4.33:::::::*`
apache	http_server	2.4.34	-	-	`cpe:2.3:a:apache:http_server:2.4.34:::::::*`
apache	http_server	2.4.35	-	-	`cpe:2.3:a:apache:http_server:2.4.35:::::::*`
apache	http_server	2.4.37	-	-	`cpe:2.3:a:apache:http_server:2.4.37:::::::*`
apache	http_server	2.4.38	-	-	`cpe:2.3:a:apache:http_server:2.4.38:::::::*`
oracle	communications_element_manager	8.0.0	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.0.0:::::::*`
oracle	communications_element_manager	8.1.0	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.1.0:::::::*`
oracle	communications_element_manager	8.1.1	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.1.1:::::::*`
oracle	communications_element_manager	8.2.0	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.2.0:::::::*`
oracle	communications_session_report_manager	8.1.1	-	-	`cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:::::::*`
oracle	communications_session_report_manager	8.2.0	-	-	`cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:::::::*`
oracle	communications_session_report_manager	8.2.1	-	-	`cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:::::::*`
oracle	communications_session_route_manager	8.1.1	-	-	`cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:::::::*`
oracle	communications_session_route_manager	8.2.0	-	-	`cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:::::::*`
oracle	communications_session_route_manager	8.2.1	-	-	`cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:::::::*`
oracle	enterprise_manager_ops_center	12.3.3	-	-	`cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:::::::*`
oracle	enterprise_manager_ops_center	12.4.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:::::::*`
oracle	http_server	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:http_server:12.2.1.4.0:::::::*`
oracle	instantis_enterprisetrack	*	-	-	`cpe:2.3:a:oracle:instantis_enterprisetrack::::::::`
oracle	retail_xstore_point_of_service	7.1	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2019:4126 vendor-advisory
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问

[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
cve.org

访问