Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to HTTP response splitting and denial of service attacks (CVE-2022-37436, CVE-2006-20001)

Summary

IBM HTTP Server (powered by Apache) for IBM i is vulnerable to HTTP response splitting attacks due to a use of malicious backend and a denial of service attack due to an out-of-bounds read or write as described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to the Apache HTTP Server implementation as described in the Remediation/Fixes section.

Vulnerability Details

CVEID:CVE-2022-37436
**DESCRIPTION:**Apache HTTP Server is vulnerable to HTTP response splitting attacks, caused by the use of a malicious backend by mod_proxy. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/244885 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2006-20001
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service, caused by an out-of-bounds read or write of zero in mod_dav. By sending a specially crafted If: request header, an attacker could exploit this vulnerability to cause the process to crash.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/244883 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

The issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers contain the fix for the vulnerabilities.

IBM i Release| 5770-DG1
PTF Number| PTF Download Link
—|—|—
7.5| SI82700
SI82701| <https://www.ibm.com/support/pages/ptf/SI82700&gt;
<https://www.ibm.com/support/pages/ptf/SI82701&gt;
7.4| SI82702
SI82703| <https://www.ibm.com/support/pages/ptf/SI82702&gt;
<https://www.ibm.com/support/pages/ptf/SI82703&gt;
7.3| SI82704
SI82705| <https://www.ibm.com/support/pages/ptf/SI82704&gt;
<https://www.ibm.com/support/pages/ptf/SI82705&gt;
7.2| SI82706
SI82707| <https://www.ibm.com/support/pages/ptf/SI82706&gt;
<https://www.ibm.com/support/pages/ptf/SI82707&gt;

<https://www.ibm.com/support/fixcentral&gt;

_Important note: _IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None