K17251 : Apache vulnerability CVE-2015-3183

Security Advisory Description

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. (CVE-2015-3183)

Impact

An attacker with access to the plaintext data of a connection to the BIG-IP control plane may be able to exploit a flaw in Apache to partially impact the integrity of a session.

Note: All connections to the BIG-IP Configuration utility are encrypted with SSL/TLS, so an attacker would need to be able to decrypt the cipher text and obtain the plaintext before launching this attack.