ASA-2019-00172 – Apache HTTP Server: mod_auth_digest access control bypass


Allele Security Alert

ASA-2019-00172

Identifier(s)

ASA-2019-00172, CVE-2019-0217

Title

mod_auth_digest access control bypass

Vendor(s)

Apache Software Foundation

Product(s)

Apache HTTP Server (httpd)

Affected version(s)

Apache HTTP Server versions 2.4.0 to 2.4.38

Fixed version(s)

Apache HTTP Server version 2.4.39

Proof of concept

Unknown

Description

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Technical details

Unknown

Credits

Simon Kappel

Reference(s)

httpd 2.4 vulnerabilities – The Apache HTTP Server Project
https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2019-0217: mod_auth_digest access control bypass
https://seclists.org/oss-sec/2019/q2/4

CVE-2019-0217
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0217

CVE-2019-0217
https://nvd.nist.gov/vuln/detail/CVE-2019-0217

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: October 2, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.