Rapid7 Vulnerability & Exploit Database

Apache HTTPD: ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167)

Back to Search

Apache HTTPD: ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
06/20/2017
Created
07/25/2018
Added
06/20/2017
Modified
01/08/2018

Description

Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request.

Solution(s)

  • apache-httpd-upgrade-2_2_34
  • apache-httpd-upgrade-2_4_26

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;