Ask the Community
Groups
CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2017-3167</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p>It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.<br><br>Unitrends risk assessment: Medium, or None if current security update is applied<br> </p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p>For CentOS6, Unitrends security update dated 11/06/2017 or later has httpd-2.2.15-60.el6.centos.6 and this issue was fixed in httpd-2.2.15-60.el6.centos.5 / httpd-2.2.15-60.el6_9.5<br>For CentOS5, the system should be migrated to CentOS6.<br> </p> <h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fcve%2Fcve-2017-3167%250D%250Ahttps%3A%2F%2Faccess.redhat.com%2Ferrata%2FRHSA-2017%3A2478">https://access.redhat.com/security/cve/cve-2017-3167 https://access.redhat.com/errata/RHSA-2017:2478</a></li></ul> </article> </main>