Home / Security / Advisories / NTAP-20180601-0002

NTAP-20180601-0002 — June 2017 Apache HTTP Server Vulnerabilities in NetApp Products

Published 2018-06-01 · Updated 2019-03-14 · Status: Final · Exploitation: Public · Severity: CRITICAL 9.8 · ONTAP affected: Yes

Official advisory: NTAP-20180601-0002 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP · OnCommand family · StorageGRID | ONTAP-relevant | highest CVSS: 9.8

CVEs in this advisory

CVE-2017-3167 — CRITICAL · CVSS 9.8 · site index
CVE-2017-3169 — CRITICAL · CVSS 9.8 · site index
CVE-2017-7659 — HIGH · CVSS 7.5 · site index
CVE-2017-7668 — HIGH · CVSS 7.5 · site index
CVE-2017-7679 — CRITICAL · CVSS 9.8 · site index

What the CVE records say

CVE-2017-3167 — In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVE-2017-3169 — In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

CVE-2017-7659 — A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

CVE-2017-7668 — The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

CVE-2017-7679 — In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.

Impact

Successful exploitation of these vulnerabilities could lead to privilege escalation, information disclosure, or Denial of Service (DoS).

Affected products

Clustered Data ONTAP
OnCommand Unified Manager for 7-Mode (core package)
StorageGRID (formerly StorageGRID Webscale)

Official fixes

OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗
OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗
StorageGRID (formerly StorageGRID Webscale) — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗

References

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.