Apache – CVE-2016-4975

Description

Kayran has detected that the Version of Apache HTTP Server being used is vulnerable to Improper Neutralization of CRLF Sequences, aka ‘CRLF Injection’ (CWE-93). This type is also being referred to as “HTTP response splitting”.
Also known as CVE-2016-4975.

A possible CRLF injection allowing HTTP response splitting attacks for sites that uses mod_userdir.
By prohibiting CR or LF injection into the “Location” or other outbound header key or value in later version, the issue got resolved.

There’s a chance that this vulnerability will allow attackers to modify system files and information.

Recommendation

To fix CVE-2016-4975, upgrade the version of Apache HTTP Server being used to either 2.2.32 or 2.4.25.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4975

https://cwe.mitre.org/data/definitions/93.html

< Return to all Vulnerabilities

Active Directory Hacking

What does Active Directory mean? The Active Directory infrastructure is a critical infrastructure in most organizations, and it forms the backbone of the organization’s computing

Read More »

Man-In-The-Middle Attacks

Do you know these people who just push themselves into conversations?That’s Man-In-The-Middle Attacks. And from a wider angle, Man-In-The-Middle Attacks, or MITM, are built around

Read More »

Using VPN

What is a VPN? Why should someone be using VPN? Which Problems does is solve? and what is the advantages and disadvantages of it? Let’s

Read More »