Home / Security / Advisories / NTAP-20180423-0001

NTAP-20180423-0001 — December 2016 Apache HTTP Server Vulnerabilities in Multiple NetApp Products

Published 2018-04-23 · Updated 2018-06-21 · Status: Final · Exploitation: Not public · Severity: HIGH 7.5 · ONTAP affected: Yes

Official advisory: NTAP-20180423-0001 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP · OnCommand family | ONTAP-relevant | highest CVSS: 7.5

CVEs in this advisory

CVE-2016-0736 — HIGH · CVSS 7.5 · site index
CVE-2016-2161 — HIGH · CVSS 7.5 · site index
CVE-2016-8740 — HIGH · CVSS 7.5 · site index
CVE-2016-8743 — HIGH · CVSS 7.5 · site index

What the CVE records say

CVE-2016-0736 — In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.

CVE-2016-2161 — In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

CVE-2016-8740 — The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

CVE-2016-8743 — Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

Impact

Successful exploitation of these vulnerabilities could lead to disclosure of potentially sensitive information, addition or modification of data, or Denial of Service (DoS).

Affected products

Clustered Data ONTAP
OnCommand Unified Manager for 7-Mode (core package)

Official fixes

OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗
OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗

References

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.