CVE - CVE-2015-3185

CVE-ID
CVE-2015-3185	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:http://httpd.apache.org/security/vulnerabilities_24.html CONFIRM:http://www.apache.org/dist/httpd/CHANGES_2.4 CONFIRM:https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708 CONFIRM:https://support.apple.com/kb/HT205031 CONFIRM:https://support.apple.com/HT205217 CONFIRM:https://support.apple.com/HT205219 APPLE:APPLE-SA-2015-08-13-2 URL:http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html APPLE:APPLE-SA-2015-09-16-2 URL:http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html APPLE:APPLE-SA-2015-09-16-4 URL:http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html DEBIAN:DSA-3325 URL:http://www.debian.org/security/2015/dsa-3325 REDHAT:RHSA-2015:1667 URL:http://rhn.redhat.com/errata/RHSA-2015-1667.html REDHAT:RHSA-2017:2708 URL:https://access.redhat.com/errata/RHSA-2017:2708 REDHAT:RHSA-2017:2709 URL:https://access.redhat.com/errata/RHSA-2017:2709 REDHAT:RHSA-2017:2710 URL:https://access.redhat.com/errata/RHSA-2017:2710 SUSE:openSUSE-SU-2015:1684 URL:http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html UBUNTU:USN-2686-1 URL:http://www.ubuntu.com/usn/USN-2686-1 BID:75965 URL:http://www.securityfocus.com/bid/75965 SECTRACK:1032967 URL:http://www.securitytracker.com/id/1032967
Assigning CNA
N/A
Date Entry Created
20150410	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150410)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org