Loading vulnerability…
Uninitialized Memory Disclosure in Apache HTTP Server mod_auth_digest
CVE-2017-9788 is an uninitialized-memory vulnerability in Apache HTTP Server's mod_auth_digest module affecting versions 2.2.0–2.2.33 and 2.4.1–2.4.26. During parsing of Digest Authorization or Proxy-Authorization headers, the module fails to initialize or reset a value placeholder before and between successive key=value assignments. A crafted header beginning with a key without an equals-sign assignment can cause stale pool memory from a previous request to be reflected, potentially exposing confidential information. The flaw can also trigger a segmentation fault and crash an httpd child process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote attackers can potentially disclose confidential information retained in server pool memory from previous requests. Malformed Digest authentication headers can also crash an httpd child process, resulting in denial of service. The information exposed and reliability of exploitation depend on the server's memory state.
If you can’t patch tonight, do this now.
If Digest authentication is not required, disable auth_digest_module by removing or commenting out its LoadModule directive, restart httpd, and verify that the module is no longer loaded. Restrict network access to affected services until a fixed release or vendor update can be deployed.
Patch, then assume compromise.
Upgrade to a supported Apache HTTP Server release containing the fix. The original fixed upstream releases are 2.2.34 and 2.4.27. Alternatively, install the applicable vendor security update containing a backported fix; an older upstream version number alone does not establish vulnerability in vendor-maintained packages. Restart httpd after applying the update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.