CVE-2019-10097
published 2019-09-26CVE-2019-10097: In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially…
PriorityP279high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
52.87%
98.9th percentile
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| debian | apache2 | < apache2 2.4.41-1 (bookworm) | apache2 2.4.41-1 (bookworm) |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | communications_session_report_manager | — | — |
| oracle | communications_session_report_manager | — | — |
| oracle | communications_session_report_manager | — | — |
| oracle | communications_session_route_manager | — | — |
| oracle | communications_session_route_manager | — | — |
| oracle | communications_session_route_manager | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | http_server | — | — |
| oracle | instantis_enterprisetrack | 17.1 – 17.3 | — |
| oracle | retail_xstore_point_of_service | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandprintf "PROXY aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" | nc localhost 6666↗
commandprintf "PROXY aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" | nc localhost 6666↗
bytes↗
\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A\x21\x32\x08\x6f\x6f
bytes↗
\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A\x20\x11\x00\x00
- →Detect oversized PROXY v1 headers: alert on any PROXY protocol v1 line beginning with 'PROXY ' that exceeds 108 bytes (sizeof hdr->v1.line) before the CRLF terminator, as this triggers the strcpy stack overflow in remoteip_process_v1_handler. ↗
- →Detect PROXY v2 LOCAL command (byte 13 = 0x20) sent to httpd listeners with mod_remoteip/RemoteIPProxyProtocol enabled; this triggers a NULL pointer dereference via HDR_DONE returned without populating client_addr. ↗
- →Detect PROXY v2 messages with unsupported address family/protocol (default case in fam switch) sent to httpd; these also return HDR_DONE without populating client_addr, causing a NULL pointer dereference crash. ↗
- →Scan Apache httpd configuration for RemoteIP* directives to identify hosts vulnerable to CVE-2019-10097; the flaw is only exploitable when such directives are present. ↗
- →Monitor for httpd worker thread SIGSEGV crashes (segmentation faults) in mod_remoteip.c around line 1248 (ap_log_cerror APLOGNO 03511), which is the NULL pointer dereference site for the PROXY v2 exploit path. ↗
- →The vulnerability affects only connections from configured trusted proxy IPs; detection should focus on PROXY protocol traffic arriving on the httpd listener port from those trusted intermediary addresses, not from arbitrary HTTP clients. ↗
- ·CVE-2019-10097 is only exploitable when mod_remoteip is loaded AND RemoteIPProxyProtocol is enabled in the Apache httpd configuration. Instances without these directives are not affected. ↗
- ·The exploit can only be delivered by a host that is configured as a trusted proxy (via RemoteIPTrustedProxy or equivalent); untrusted HTTP clients cannot trigger this vulnerability. ↗
- ·Both PROXY protocol version 1 (ASCII) and version 2 (binary) request paths are affected; detection rules must cover both wire formats. ↗
- ·Red Hat Enterprise Linux 5, 6, and 7 ship httpd versions that are not affected; only RHSCL and JBoss packages in the 2.4.32–2.4.39 range require patching. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
osv7.2HIGH
vulncheck7.2HIGH
vendor_debian7.2HIGH
vendor_oracle7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache HTTP Server) — CVE-2019-10097
vendor_oracle·2020-10-15·CVSS 7.2
CVE-2019-10097 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache HTTP Server) — CVE-2019-10097
Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache HTTP Server) vulnerability
CVE: CVE-2019-10097
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2019-09-17·CVSS 4.2
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-4113-1 introduced a regression in Apache.
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situ
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache.
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during
Red Hat
httpd: null-pointer dereference in mod_remoteip
vendor_redhat·2019-08-14·CVSS 7.2
CVE-2019-10097 [HIGH] CWE-120 httpd: null-pointer dereference in mod_remoteip
httpd: null-pointer dereference in mod_remoteip
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
A vulnerability was discovered in Apache httpd, in mod_remoteip. A trusted proxy using the "PROXY" protocol could send specially crafted headers that can cause httpd to experience a stack buffer overflow or NULL pointer dereference, leading to a crash or other potential consequences.
This issue could only be exploited by configured trusted intermediate proxy servers. HTTP clients such as browsers could not expl
Debian
CVE-2019-10097: apache2 - In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a t...
vendor_debian·2019·CVSS 7.2
CVE-2019-10097 [HIGH] CVE-2019-10097: apache2 - In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a t...
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Scope: local
bookworm: resolved (fixed in 2.4.41-1)
bullseye: resolved (fixed in 2.4.41-1)
forky: resolved (fixed in 2.4.41-1)
sid: resolved (fixed in 2.4.41-1)
trixie: resolved (fixed in 2.4.41-1)
GHSA
GHSA-x7xg-9vq9-q8xh: In Apache HTTP Server 2
ghsa_unreviewed·2022-05-24
CVE-2019-10097 [MEDIUM] CWE-787 GHSA-x7xg-9vq9-q8xh: In Apache HTTP Server 2
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
OSV
CVE-2019-10097: In Apache HTTP Server 2
osv·2019-09-26·CVSS 7.2
CVE-2019-10097 [HIGH] CVE-2019-10097: In Apache HTTP Server 2
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
OSV
apache2 regression
osv·2019-09-17·CVSS 4.2
[MEDIUM] apache2 regression
apache2 regression
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (dae
OSV
apache2 vulnerabilities
osv·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during connection shutdown. A remote
attacker could use this to possibly cause a
VulnCheck
Apache HTTP Server NULL Pointer Dereference
vulncheck·2019·CVSS 7.2
CVE-2019-10097 [HIGH] Apache HTTP Server NULL Pointer Dereference
Apache HTTP Server NULL Pointer Dereference
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Affected: Apache HTTP Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html
No detection rules found.
No public exploits indexed.
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
HackerOne
mod_remoteip stack buffer overflow and NULL pointer dereference
hackerone·2019-11-07·CVSS 7.2
CVE-2019-10097 [HIGH] mod_remoteip stack buffer overflow and NULL pointer dereference
mod_remoteip stack buffer overflow and NULL pointer dereference
Versions Affected:
httpd 2.4.32 to 2.4.39
Summary:
When mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY v1 or PROXY v2 header could trigger a stack buffer overflow or NULL pointer deference.
This was assigned CVE-2019-10097 and triaged by the Apache security team as a "Moderate" severity vulnerability, fixed in Apache 2.4.41: https://www.openwall.com/lists/oss-security/2019/08/15/5
The HTTPD maintainers and I collaborated on the fix: http://svn.apache.org/viewvc?view=revision&revision=1864526
Original report to Apache security team (with reproductions) follows:
Apache httpd 2.4.31+ and newer when configured with `mod_remoteip` and
`RemoteIPProxy
Bugzilla
CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip [fedora-all]
bugzilla·2019-08-21·CVSS 7.2
CVE-2019-10097 [HIGH] CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip [fedora-all]
CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
Bugzilla
CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
bugzilla·2019-08-21·CVSS 7.2
CVE-2019-10097 [HIGH] CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
A vulnerability was found in httpd, where mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1743997]
---
External References:
https://httpd.apache.org/security/vulnerabilities_24.html
---
This vulnerability is out of security support scope for the following product:
* Red Hat JBoss Web Server 3
* Red Hat JBoss Enterprise Web Server 2
Please refer to https://access.redhat.com/support/policy/updates/j
https://access.redhat.com/errata/RHSA-2019:4126https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://access.redhat.com/errata/RHSA-2019:4126https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-09-26
Published
Exploited in the wild