CVE-2015-3185
published 2015-07-20CVE-2015-3185: The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be…
PriorityP341medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
16.35%
97.0th percentile
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | httpd | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
| apple | os_x_server_v5.0.3 | — | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| apple | xcode | — | — |
| apple | xcode | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apache2 | < apache2 2.4.16-1 (bookworm) | apache2 2.4.16-1 (bookworm) |
| php5 | php5 | >= 0 < 5.5.9+dfsg-1ubuntu4.16 | 5.5.9+dfsg-1ubuntu4.16 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_apache4.3LOW
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2015-07-27·CVSS 5.0
CVE-2015-3183 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in the Apache HTTP server.
It was discovered that the Apache HTTP Server incorrectly parsed chunk
headers. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2015-3183)
It was discovered that the Apache HTTP Server incorrectly handled the
ap_some_auth_required API. A remote attacker could possibly use this issue
to bypass intended access restrictions. This issue only affected Ubuntu
14.04 LTS and Ubuntu 15.04. (CVE-2015-3185)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
vendor_redhat·2015-07-15·CVSS 4.3
CVE-2015-3185 [MEDIUM] CWE-287 httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied.
Package: httpd (
Debian
CVE-2015-3185: apache2 - The ap_some_auth_required function in server/request.c in the Apache HTTP Server...
vendor_debian·2015·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185: apache2 - The ap_some_auth_required function in server/request.c in the Apache HTTP Server...
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Scope: local
bookworm: resolved (fixed in 2.4.16-1)
bullseye: resolved (fixed in 2.4.16-1)
forky: resolved (fixed in 2.4.16-1)
sid: resolved (fixed in 2.4.16-1)
trixie: resolved (fixed in 2.4.16-1)
Apple
CVE-2015-3185: Xcode 7.0
vendor_apple·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185: Xcode 7.0
Apple Security Update: About the security content of Xcode 7.0
Product: Xcode
Version: 7.0
CVE: CVE-2015-3185
Component: CVE-ID
Apache
Apache httpd: CVE-2015-3185
vendor_apache·CVSS 4.3
CVE-2015-3185 [LOW] Apache httpd: CVE-2015-3185
Apache httpd: CVE-2015-3185
A design error in the "ap_some_auth_required" function renders the API unusuable in httpd 2.4.x. In particular the API is documented to answering if the request required authentication but only answers if there are Require lines in the applicable configuration. Since 2.4.x Require lines are used for authorization as well and can appear in configurations even when no authentication is required and the request is entirely unrestricted. This could lead to modules using this API to allow access when they should otherwise not do so. API users should use the new ap_some_authn_required API added in 2.4.16 instead. Acknowledgements: This issue was reported by Ben Reser. Reported to security team 2013-08-05 Issue public 2015-06-09 Update 2.4.16 released 2015-07-15 Affect
Apple
CVE-2015-3185: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-3185
Component: CVE-2015-3185
Impact: Multiple vulnerabilities existed in PHP 5.5.20, the most serious of which may lead to arbitrary code execution.
Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.20. These were addressed by updating Apache to version 5.5.27.
Apple
CVE-2015-3185: OS X Server v5.0.3
vendor_apple·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185: OS X Server v5.0.3
Apple Security Update: About the security content of OS X Server v5.0.3
Product: OS X Server v5.0.3
CVE: CVE-2015-3185
Component: CVE-2015-3185
GHSA
GHSA-5fv4-m5x3-j32p: The ap_some_auth_required function in server/request
ghsa_unreviewed·2022-05-13
CVE-2015-3185 [MEDIUM] GHSA-5fv4-m5x3-j32p: The ap_some_auth_required function in server/request
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
OSV
php5 vulnerabilities
osv·2016-04-21·CVSS 4.3
CVE-2014-9767 php5 vulnerabilities
php5 vulnerabilities
It was discovered that the PHP Zip extension incorrectly handled
directories when processing certain zip files. A remote attacker could
possibly use this issue to create arbitrary directories. (CVE-2014-9767)
It was discovered that the PHP Soap client incorrectly validated data
types. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-8835, CVE-2016-3185)
It was discovered that the PHP MySQL native driver incorrectly handled TLS
connections to MySQL databases. A machine-in-the-middle attacker could possibly
use this issue to downgrade and snoop on TLS connections. This
vulnerability is known as BACKRONYM. (CVE-2015-8838)
It was discovered that PHP incorrectly handled the imag
OSV
apache2 vulnerabilities
osv·2015-07-27·CVSS 5.0
CVE-2015-3183 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly parsed chunk
headers. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2015-3183)
It was discovered that the Apache HTTP Server incorrectly handled the
ap_some_auth_required API. A remote attacker could possibly use this issue
to bypass intended access restrictions. This issue only affected Ubuntu
14.04 LTS and Ubuntu 15.04. (CVE-2015-3185)
OSV
CVE-2015-3185: The ap_some_auth_required function in server/request
osv·2015-07-20·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185: The ap_some_auth_required function in server/request
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-3185 php: Type confusion vulnerability in make_http_soap_request()
bugzilla·2016-03-07·CVSS 9.8
CVE-2016-3185 [CRITICAL] CVE-2016-3185 php: Type confusion vulnerability in make_http_soap_request()
CVE-2016-3185 php: Type confusion vulnerability in make_http_soap_request()
It was found that due to an insufficient validation of the cookies field when making SOAP http request through https://github.com/php/php-src/blob/master/ext/soap/php_http.c#L835 , there is lack of validation of 2nd/3rd elements in cookies array, which results in type confusion when they are no longer string.
Upstream bug:
https://bugs.php.net/bug.php?id=71610
Upstream patch:
https://git.php.net/?p=php-src.git;a=commit;h=eaf4e77190d402ea014207e9a7d5da1a4f3727ba
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1315347]
---
CVE assignment:
http://seclists.org/oss-sec/2016/q1/669
---
This issue is a sub-set of issues under CVE-2015-8835 (bug 1323074). It seems the fix for tha
Bugzilla
CVE-2015-3184 subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4
bugzilla·2015-07-27·CVSS 5.0
CVE-2015-3184 [MEDIUM] CVE-2015-3184 subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4
CVE-2015-3184 subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4
Below is the upstream report about a security issue in Subversion:
Summary
Subversion's mod_authz_svn does not properly restrict anonymous
access in some mixed anonymous/authenticated environments when using
Apache httpd 2.4. The result is that anonymous access may be possible
to files for which only authenticated access should be possible.
Known vulnerable
CVE-2015-3185 Apache httpd 2.4.0 to 2.4.12
CVE-2015-3184 Apache Subversion 1.8.0 to 1.8.13
CVE-2015-3184 Apache Subversion 1.7.0 to 1.7.20
Servers are vulnerable if either httpd or Subversion is as listed.
Subversion 1.6 does not build with httpd 2.4 and servers using
httpd 2.2 are not vulnerable. Servers that are configured to deny
anonymous
Bugzilla
CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
bugzilla·2015-07-16·CVSS 5.0
CVE-2015-3185 [MEDIUM] CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
CVE-2015-3185 CVE-2015-3183 CVE-2015-0253 httpd: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fe
Bugzilla
CVE-2015-3185 httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
bugzilla·2015-07-16·CVSS 4.3
CVE-2015-3185 [MEDIUM] CVE-2015-3185 httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
CVE-2015-3185 httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
Apache HTTP Server 2.4.16 release fixes the following issue:
*) SECURITY: CVE-2015-3185 (cve.mitre.org)
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
with new ap_some_authn_required and ap_force_authn hook. [Ben Reser]
External References:
http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1243894]
---
httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
This issue was actually fixed in version 2.4.14. However, as versions 2.4.14 and 2.4.15 were not released, 2.4.16 is the f
Tenable
[R4] SecurityCenter 5.0.2 Fixes Third-party Library
blogs_tenable·2015-08-20
[R4] SecurityCenter 5.0.2 Fixes Third-party Library
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
CTF
Jacob the Boss / Readme
ctf_writeups·CVSS 9.8
CVE-2023-38408 [CRITICAL] Jacob the Boss / Readme
# [Jacob the Boss - TryHackMe writeup](https://tryhackme.com/room/jacobtheboss)
Find a way in and learn a little more.
## Task 1
Well, the flaw that makes up this box is the reproduction found in the production environment of a customer a while ago, the verification in season consisted of two steps, the last one within the environment, we hit it head-on and more than 15 machines were vulnerable that together with the development team we were able to correct and adapt.
*First of all, add the jacobtheboss.box address to your hosts file.*
Anyway, learn a little more, have fun!
Answer the questions below
### user.txt
```
f4d491f280de360cc49e26ca1587cbcc
```
### root.txt
```
29a5641eaa0c01abe5749608c8232806
```
## Initial Enumeration
I started with a full port and service scan usi
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00002.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1666.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1667.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttp://www.apache.org/dist/httpd/CHANGES_2.4http://www.debian.org/security/2015/dsa-3325http://www.securityfocus.com/bid/75965http://www.securitytracker.com/id/1032967http://www.ubuntu.com/usn/USN-2686-1https://access.redhat.com/errata/RHSA-2017:2708https://access.redhat.com/errata/RHSA-2017:2709https://access.redhat.com/errata/RHSA-2017:2710https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708https://github.com/apache/httpd/commit/db81019ab88734ed35fa70294a0cfa7a19743f73https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://support.apple.com/HT205217https://support.apple.com/HT205219https://support.apple.com/kb/HT205031http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00002.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1666.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1667.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttp://www.apache.org/dist/httpd/CHANGES_2.4http://www.debian.org/security/2015/dsa-3325http://www.securityfocus.com/bid/75965http://www.securitytracker.com/id/1032967http://www.ubuntu.com/usn/USN-2686-1https://access.redhat.com/errata/RHSA-2017:2708https://access.redhat.com/errata/RHSA-2017:2709https://access.redhat.com/errata/RHSA-2017:2710https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708https://github.com/apache/httpd/commit/db81019ab88734ed35fa70294a0cfa7a19743f73https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://support.apple.com/HT205217https://support.apple.com/HT205219https://support.apple.com/kb/HT205031
2015-07-20
Published