CVE-2017-9798
published 2017-09-18CVE-2017-9798: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has…
PriorityP185high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEVRansomwareInitial access
Exploited in the wild
EPSS
95.00%
99.9th percentile
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | <= 2.2.34 | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | — | — |
| apple | macos_high_sierra_10.13.2_security_update_2017-002_sierra_and_security_update_20 | — | — |
| debian | apache2 | < apache2 2.4.27-6 (bookworm) | apache2 2.4.27-6 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for HTTP OPTIONS requests or requests with unknown/arbitrary HTTP methods that elicit an Allow header in the response — both can trigger the memory leak. ↗
- →Any HTTP request that forces the server to send an Allow header (e.g., a 501 Method Not Implemented response to an unknown method) can trigger the vulnerability — not just OPTIONS requests. ↗
- →Inspect HTTP responses for anomalous or garbled data appended to the Allow header beyond standard method names — this is the indicator of memory being leaked via the use-after-free bug. ↗
- →The leak can repeat and grow with successive requests; monitor for repeated unauthenticated OPTIONS or unknown-method requests to the same resource as a behavioral indicator of active exploitation. ↗
- ·The vulnerability only triggers if the Limit directive is set in a .htaccess file with an invalid/custom HTTP method, OR if httpd.conf has certain misconfigurations — servers without such configurations are not affected. ↗
- ·The patch restricts the Limit directive to httpd.conf only (disallowing it in .htaccess) and only adds new methods when cmd->temp_pool equals cmd->pool — detection rules targeting .htaccess-based exploitation will not apply to patched servers. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
vendor_apache7.5LOW
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jxf6-fx3m-8x2r: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's
ghsa_unreviewed·2022-05-13
CVE-2017-9798 [HIGH] CWE-416 GHSA-jxf6-fx3m-8x2r: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
OSV
CVE-2017-9798: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's
osv·2017-09-18·CVSS 7.5
CVE-2017-9798 [HIGH] CVE-2017-9798: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
VulnCheck
Apache HTTP Server Use After Free
vulncheck·2017·CVSS 7.5
CVE-2017-9798 [HIGH] Apache HTTP Server Use After Free
Apache HTTP Server Use After Free
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Affected: Apache HTTP Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the produ
Apple
CVE-2017-9798: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
vendor_apple·2017-12-06·CVSS 7.5
CVE-2017-9798 [HIGH] CVE-2017-9798: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
Product: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
CVE: CVE-2017-9798
Component: APFS
Impact: APFS encryption keys may not be securely deleted after hibernating
Description: A logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.
Ubuntu
Apache HTTP Server vulnerability
vendor_ubuntu·2017-10-24
CVE-2017-9798 Apache HTTP Server vulnerability
Title: Apache HTTP Server vulnerability
Summary: Apache HTTP Server could be made to expose sensitive information over the
network.
USN-3425-1 fixed a vulnerability in Apache HTTP Server. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a remote
attacker could possibly use this issue to read arbitrary server memory,
including sensitive information. This issue is known as Optionsbleed.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apache HTTP Server vulnerability
vendor_ubuntu·2017-09-19
CVE-2017-9798 Apache HTTP Server vulnerability
Title: Apache HTTP Server vulnerability
Summary: Apache HTTP Server could be made to expose sensitive information over the
network.
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a remote
attacker could possibly use this issue to read arbitrary server memory,
including sensitive information. This issue is known as Optionsbleed.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
vendor_redhat·2017-09-18·CVSS 7.5
CVE-2017-9798 [HIGH] CWE-416 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTT
Debian
CVE-2017-9798: apache2 - Apache httpd allows remote attackers to read secret data from process memory if ...
vendor_debian·2017·CVSS 7.5
CVE-2017-9798 [HIGH] CVE-2017-9798: apache2 - Apache httpd allows remote attackers to read secret data from process memory if ...
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Scope: local
bookworm: resolved (fixed in 2.4.27-6)
bullseye: resolved (fixed in 2.4.27-6)
forky: resolved (fixed in 2.4.27-6)
sid: resolved (fixed in 2.4.27-6)
trixie: res
Apache
Apache httpd: CVE-2017-9798
vendor_apache·CVSS 7.5
CVE-2017-9798 [LOW] Apache httpd: CVE-2017-9798
Apache httpd: CVE-2017-9798
When an unrecognized HTTP Method is given in an directive in an .htaccess file, and that .htaccess file is processed by the corresponding request, the global methods table is corrupted in the current worker process, resulting in erratic behaviour. This behavior may be avoided by listing all unusual HTTP Methods in a global httpd.conf RegisterHttpMethod directive in httpd release 2.4.25 and later. To permit other .htaccess directives while denying the directive, see the AllowOverrideList directive. Source code patch (2.4) is at; CVE-2017-9798-patch-2.4.patch Source code patch (2.2) is at; CVE-2017-9798-patch-2.2.patch Note 2.2 is end-of-life, no further release with this fix is planned. Users are encouraged to migrate to 2.4.28 or later for this and other fixes.
Suricata
ET WEB_SERVER OptionsBleed (CVE-2017-9798)
suricata·2017-09-19·CVSS 7.5
CVE-2017-9798 [HIGH] ET WEB_SERVER OptionsBleed (CVE-2017-9798)
ET WEB_SERVER OptionsBleed (CVE-2017-9798)
Rule: alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER OptionsBleed (CVE-2017-9798)"; flow:established,to_client; http.header; header_lowercase; content:"allow|3a 20|"; pcre:"/^[^\n]+(?:[^ -~\x0d\x0a]|,\x20*,)/R"; reference:cve,CVE-2017-9798; classtype:misc-activity; sid:2024760; rev:6; metadata:affected_product Apache_HTTP_server, attack_target Server, created_at 2017_09_19, deployment Datacenter, performance_impact Significant, signature_severity Minor, updated_at 2024_04_20;)
Exploit-DB
Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak
exploitdb·2017-09-18·CVSS 7.5
CVE-2017-9798 [HIGH] Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak
Apache len(set(z)):
print("[duplicates] %s: %s" % (url, repr(allow)))
elif args.all:
print("[ok] %s: %s" % (url, repr(allow)))
elif re.match("^[a-zA-Z]+(-[a-zA-Z]+)? *( +[a-zA-Z]+(-[a-zA-Z]+)? *)+$", allow):
print("[spaces] %s: %s" % (url, repr(allow)))
else:
print("[bleed] %s: %s" % (url, repr(allow)))
return True
parser = argparse.ArgumentParser(
description='Check for the Optionsbleed vulnerability (CVE-2017-9798).',
epilog="Tests server for Optionsbleed bug and other bugs in the allow header.\n\n"
"Autmatically checks http://, https://, http://www. and https://www. -\n"
"except if you pass -u/--url (which means by default we check 40 times.)\n\n"
"Explanation of results:\n"
"[bleed] corrupted header found, vulnerable\n"
"[empty] empty allow header, does not make sense\n"
"[spaces] sp
Metasploit
Apache Optionsbleed Scanner
metasploit
Apache Optionsbleed Scanner
Apache Optionsbleed Scanner
This module scans for the Apache optionsbleed vulnerability where the Allow response header returned from an OPTIONS request may bleed memory if the server has a .htaccess file with an invalid Limit method defined.
HackerOne
Optionsbleed / CVE-2017-9798
hackerone·2018-05-03·CVSS 7.5
CVE-2017-9798 [HIGH] Optionsbleed / CVE-2017-9798
Optionsbleed / CVE-2017-9798
Bug has been disclosed here:
https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
poc code:
https://github.com/hannob/optionsbleed
Apache is currently preparing 2.4.28, which will contain the fix, a patch is available in their svn repo.
Bugzilla
CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) [fedora-all]
bugzilla·2017-09-18·CVSS 7.5
CVE-2017-9798 [HIGH] CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) [fedora-all]
CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
bugzilla·2017-09-11·CVSS 7.5
CVE-2017-9798 [HIGH] CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
A use-after free vulnerability was found in apache httpd. There's an apache configuration directive that can be used to restrict access to certain HTTP methods. If one sets this inside an .htaccess file with an HTTP method that's not registered in the server the bug happens (e.g. set in .htaccess). The reason is that at that point the variables used to build up the "Allow" header have already been freed, as it's not expecting any more changes to it.
Note that the bug only appears with OPTIONS requests to a specific path, not with "*" OPTIONS requests.
An attacker on a shared hosting could could deliberately create an .htaccess file triggering the bug and subsequently try to exfiltrate data pieces fro
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Sfruttamento vulnerabilità
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez Sep 22, 2017 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Exploits & Vulnerabilities
# OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez
2017/09/22
Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with t
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez Sep 22, 2017 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerabilit
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Ausnutzung von Schwachstellen
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez Sep 22, 2017 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities w
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Exploits & Vulnerabilities
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez 2017/09/22 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with t
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Exploits y vulnerabilidades
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez Sep 22, 2017 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities wit
Trendmicro
OptionsBleed – The Apache HTTP Server Now Bleeds
blogs_trendmicro·2017-09-22·CVSS 7.5
CVE-2017-9798 [HIGH] OptionsBleed – The Apache HTTP Server Now Bleeds
Exploits & Vulnerabilities
## OptionsBleed – The Apache HTTP Server Now Bleeds
Found in the Apache HTTP server, CVE-2017-9798 lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with the Heartbleed vulnerability.
By: Pavan Thorat, William Gamazo Sanchez Sep 22, 2017 Read time: ( words)
Save to Folio
Updated on September 27, 2017, 4:00 PM PDT to add a technical analysis of the vulnerability.
A new vulnerability in the Apache HTTP server was found recently. Designated as CVE-2017-9798, this vulnerability lies in how Apache handles certain settings in its configuration files, resulting in memory leaks. This vulnerability is named OptionsBleed, based on its similarities with
arXiv
Identifying Key Expert Actors in Cybercrime Forums Based on their Technical Expertise
arxiv_fulltext·2025-06-03
Identifying Key Expert Actors in Cybercrime Forums Based on their Technical Expertise
Identifying Key Expert Actors in Cybercrime Forums Based on their Technical ExpertiseStudy published in the 2024 APWG Symposium on Electronic Crime Research (eCrime) available at: www.doi.org/10.1109/eCrime66200.2024.00019
Estelle Ruellan
Université de Montréal
Flare
Canada
François Labrèche
Secureworks
Canada
Masarah Paquet-Clouston
Université de Montréal
Complexity Science Hub
Canada
Study published in the 2024 APWG Symposium on Electronic Crime Research (eCrime) available at: www.doi.org/10.1109/eCrime66200.2024.00019. © 2025 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective wor
http://openwall.com/lists/oss-security/2017/09/18/2http://www.debian.org/security/2017/dsa-3980http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/100872http://www.securityfocus.com/bid/105598http://www.securitytracker.com/id/1039387https://access.redhat.com/errata/RHSA-2017:2882https://access.redhat.com/errata/RHSA-2017:2972https://access.redhat.com/errata/RHSA-2017:3018https://access.redhat.com/errata/RHSA-2017:3113https://access.redhat.com/errata/RHSA-2017:3114https://access.redhat.com/errata/RHSA-2017:3193https://access.redhat.com/errata/RHSA-2017:3194https://access.redhat.com/errata/RHSA-2017:3195https://access.redhat.com/errata/RHSA-2017:3239https://access.redhat.com/errata/RHSA-2017:3240https://access.redhat.com/errata/RHSA-2017:3475https://access.redhat.com/errata/RHSA-2017:3476https://access.redhat.com/errata/RHSA-2017:3477https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.htmlhttps://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patchhttps://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67ahttps://github.com/hannob/optionsbleedhttps://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3Ehttps://security-tracker.debian.org/tracker/CVE-2017-9798https://security.gentoo.org/glsa/201710-32https://security.netapp.com/advisory/ntap-20180601-0003/https://support.apple.com/HT208331https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_ushttps://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patchhttps://www.exploit-db.com/exploits/42745/https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.tenable.com/security/tns-2019-09http://openwall.com/lists/oss-security/2017/09/18/2http://seclists.org/fulldisclosure/2024/Sep/22http://www.debian.org/security/2017/dsa-3980http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/100872http://www.securityfocus.com/bid/105598http://www.securitytracker.com/id/1039387https://access.redhat.com/errata/RHSA-2017:2882https://access.redhat.com/errata/RHSA-2017:2972https://access.redhat.com/errata/RHSA-2017:3018https://access.redhat.com/errata/RHSA-2017:3113https://access.redhat.com/errata/RHSA-2017:3114https://access.redhat.com/errata/RHSA-2017:3193https://access.redhat.com/errata/RHSA-2017:3194https://access.redhat.com/errata/RHSA-2017:3195https://access.redhat.com/errata/RHSA-2017:3239https://access.redhat.com/errata/RHSA-2017:3240https://access.redhat.com/errata/RHSA-2017:3475https://access.redhat.com/errata/RHSA-2017:3476https://access.redhat.com/errata/RHSA-2017:3477https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.htmlhttps://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patchhttps://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67ahttps://github.com/hannob/optionsbleedhttps://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
+ 11 more references
2017-09-18
Published
Exploited in the wild