Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2017-12613

Out-of-bounds Read

Published: Oct 24, 2017 | Modified: Nov 21, 2024
CVSS 3.x
7.1
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.x
3.6 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:P
RedHat/V2
RedHat/V3
7.4 IMPORTANT
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Ubuntu
LOW
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2017-12613
CWEhttps://cwe.mitre.org/data/definitions/125.html

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

Weakness

The product reads data past the end, or before the beginning, of the intended buffer.

Affected Software

Name Vendor Start Version End Version
Portable_runtime Apache * 1.7.0 (excluding)
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el6 *
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el6 *
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el6 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el7 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el7 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el7 *
Red Hat Enterprise Linux 6 RedHat apr-0:1.3.9-5.el6_9.1 *
Red Hat Enterprise Linux 6.4 Advanced Update Support RedHat apr-0:1.3.9-5.el6_4.1 *
Red Hat Enterprise Linux 6.5 Advanced Update Support RedHat apr-0:1.3.9-5.el6_5.1 *
Red Hat Enterprise Linux 6.6 Advanced Update Support RedHat apr-0:1.3.9-5.el6_6.1 *
Red Hat Enterprise Linux 6.6 Telco Extended Update Support RedHat apr-0:1.3.9-5.el6_6.1 *
Red Hat Enterprise Linux 6.7 Extended Update Support RedHat apr-0:1.3.9-5.el6_7.1 *
Red Hat Enterprise Linux 7 RedHat apr-0:1.4.8-3.el7_4.1 *
Red Hat Enterprise Linux 7.2 Advanced Update Support RedHat apr-0:1.4.8-3.el7_2.1 *
Red Hat Enterprise Linux 7.2 Telco Extended Update Support RedHat apr-0:1.4.8-3.el7_2.1 *
Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions RedHat apr-0:1.4.8-3.el7_2.1 *
Red Hat Enterprise Linux 7.3 Extended Update Support RedHat apr-0:1.4.8-3.el7_3.1 *
Red Hat JBoss Web Server 3.1 RedHat *
Red Hat JBoss Web Server 3 for RHEL 6 RedHat mod_cluster-0:1.3.8-2.Final_redhat_2.1.ep7.el6 *
Red Hat JBoss Web Server 3 for RHEL 6 RedHat tomcat7-0:7.0.70-25.ep7.el6 *
Red Hat JBoss Web Server 3 for RHEL 6 RedHat tomcat8-0:8.0.36-29.ep7.el6 *
Red Hat JBoss Web Server 3 for RHEL 6 RedHat tomcat-native-0:1.2.8-11.redhat_11.ep7.el6 *
Red Hat JBoss Web Server 3 for RHEL 6 RedHat tomcat-vault-0:1.1.6-1.Final_redhat_1.1.ep7.el6 *
Red Hat JBoss Web Server 3 for RHEL 7 RedHat mod_cluster-0:1.3.8-2.Final_redhat_2.1.ep7.el7 *
Red Hat JBoss Web Server 3 for RHEL 7 RedHat tomcat7-0:7.0.70-25.ep7.el7 *
Red Hat JBoss Web Server 3 for RHEL 7 RedHat tomcat8-0:8.0.36-29.ep7.el7 *
Red Hat JBoss Web Server 3 for RHEL 7 RedHat tomcat-native-0:1.2.8-11.redhat_11.ep7.el7 *
Red Hat JBoss Web Server 3 for RHEL 7 RedHat tomcat-vault-0:1.1.6-1.Final_redhat_1.1.ep7.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 6 RedHat httpd24-apr-0:1.5.1-1.el6.1 *
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS RedHat httpd24-apr-0:1.5.1-1.el6.1 *
Text-Only JBCS RedHat *
Apr Ubuntu artful *
Apr Ubuntu esm-infra/xenial *
Apr Ubuntu precise/esm *
Apr Ubuntu trusty *
Apr Ubuntu trusty/esm *
Apr Ubuntu upstream *
Apr Ubuntu xenial *
Apr Ubuntu zesty *

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2025 Aqua Security Software Ltd.   Privacy Policy | Terms of Use