NVD Vulnerability Detail

CVE-2015-0253

Summary	The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Publication Date	July 21, 2015, 8:59 a.m.
Registration Date	Jan. 26, 2021, 2:43 p.m.
Last Update	Nov. 21, 2024, 11:22 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apache:http_server:2.4.12:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x:10.10.4:::::::*
cpe:2.3:o:apple:mac_os_x_server:5.0.3:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*
cpe:2.3:o:oracle:linux:7:::::::*

Related information, measures and tools

No	URL	タグ
1	http://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
2	http://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
3	http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html	Mailing List
4	http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html	Mailing List
5	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	Mailing List
6	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	Mailing List
7	http://rhn.redhat.com/errata/RHSA-2015-1666.html
8	http://rhn.redhat.com/errata/RHSA-2015-1666.html
9	http://www.apache.org/dist/httpd/CHANGES_2.4	Release Notes Vendor Advisory
10	http://www.apache.org/dist/httpd/CHANGES_2.4	Release Notes Vendor Advisory
11	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
12	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
13	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
14	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
15	http://www.securityfocus.com/bid/75964
16	http://www.securityfocus.com/bid/75964
17	http://www.securitytracker.com/id/1032967
18	http://www.securitytracker.com/id/1032967
19	https://bz.apache.org/bugzilla/show_bug.cgi?id=57531	Issue Tracking
20	https://bz.apache.org/bugzilla/show_bug.cgi?id=57531	Issue Tracking
21	https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb
22	https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb
23	https://github.com/apache/httpd/commit/be0f5335e3e73eb63253b050fdc23f252f5c8ae3
24	https://github.com/apache/httpd/commit/be0f5335e3e73eb63253b050fdc23f252f5c8ae3
25	https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
26	https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
27	https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
28	https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
29	https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
30	https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
31	https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E
32	https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E
33	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
34	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
35	https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E
36	https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E
37	https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E
38	https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E
39	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
40	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
41	https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
42	https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
43	https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
44	https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
45	https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E
46	https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E
47	https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
48	https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
49	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
50	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
51	https://support.apple.com/HT205219	Third Party Advisory
52	https://support.apple.com/HT205219	Third Party Advisory
53	https://support.apple.com/kb/HT205031	Third Party Advisory
54	https://support.apple.com/kb/HT205031	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Apache HTTP Server の server/protocol.c 内の read_request_line 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	Apache HTTP Server の server/protocol.c 内の read_request_line 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	Apache HTTP Server の server/protocol.c 内の read_request_line 関数は、プロトコルの構造体メンバを初期化しないため、サービス運用妨害 (NULL ポインタデリファレンスおよびプロセスクラッシュ) 状態にされる脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-476: NULL Pointer Dereference (NULL ポインタデリファレンス) と識別されています。 http://cwe.mitre.org/data/definitions/476.html
Possible impacts	第三者により、INCLUDES フィルタを有効にし、かつローカルの URI を指定する ErrorDocument 400 のディレクティブを有するインストールへのメソッドを欠いたリクエストを送信されることで、サービス運用妨害 (NULL ポインタデリファレンスおよびプロセスクラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 15, 2015, midnight
Registration Date	July 22, 2015, 12:19 p.m.
Last Update	Oct. 30, 2015, 4:37 p.m.

Affected System

Apache Software Foundation

Apache HTTP Server 2.4.12

アップル

Apple Mac OS X 10.10 から 10.10.4

Apple Mac OS X 10.9.5

macOS Server (旧 OS X Server) 5.0.3 未満 (OS X Yosemite v10.10.5 以降)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-0253	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0253
National Vulnerability Database (NVD)
2	CVE-2015-0253	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0253

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Apache httpd 2.4 vulnerabilities
1	Fixed in Apache httpd 2.4.16	http://httpd.apache.org/security/vulnerabilities_24.html
Apple Mailing Lists
2	APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006	http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
3	APPLE-SA-2015-09-16-4 OS X Server 5.0.3	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
Apple Security Updates
4	HT205031	http://support.apple.com/en-us/HT205031
5	HT205219	https://support.apple.com/en-us/HT205219
Apple セキュリティアップデート
6	HT205031	http://support.apple.com/ja-jp/HT205031
7	HT205219	http://support.apple.com/ja-jp/HT205219
ASF Bugzilla
8	Bug 57531	https://bz.apache.org/bugzilla/show_bug.cgi?id=57531
Changes with Apache
9	Changes with Apache 2.4.13	http://www.apache.org/dist/httpd/CHANGES_2.4
GitHub
10	*) SECURITY: CVE-2015-0253 (cve.mitre.org)	https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb
Oracle Technology Network
11	Oracle Solaris Third Party Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Turbolinux Security Advisory
12	TLSA-2015-17	http://www.turbolinux.co.jp/security/2015/TLSA-2015-17j.html

その他

No	Name	URL
JVN
1	JVNVU#99970459	http://jvn.jp/vu/JVNVU99970459/index.html

Change Log

No	Changed Details	Date of change
0	[2015年07月22日] 掲載 [2015年08月31日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT205031) を追加ベンダ情報：アップル (APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006) を追加 [2015年09月07日] ベンダ情報：ターボリナックス (TLSA-2015-17) を追加 [2015年10月05日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (APPLE-SA-2015-09-16-4 OS X Server 5.0.3) を追加ベンダ情報：アップル (HT205219) を追加参考情報：JVN (JVNVU#99970459) を追加 [2015年10月30日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - October 2015) を追加	Feb. 17, 2018, 10:37 a.m.