CVE-2016-0736

Vulnerability

In Apache HTTP Server versions 2.4.0 through 2.4.23, the mod_session_crypto module encrypts session data and cookies using the configured ciphers with either CBC or ECB modes of operation (AES256-CBC by default). No selectable or built-in authenticated encryption is provided, making the implementation vulnerable to padding oracle attacks [1][2].

Exploitation

An attacker with network access to observe encrypted session cookies can perform a padding oracle attack by sending modified ciphertexts to the server and observing the server's response (e.g., error messages or timing differences). This allows the attacker to decrypt the session data byte by byte without knowing the encryption key [2].

Impact

Successful exploitation leads to disclosure of the plaintext session data, which may contain sensitive information such as authentication tokens or user attributes. The attacker can then potentially forge valid session cookies, leading to session hijacking and unauthorized access [1][2].

Mitigation

Upgrade to Apache HTTP Server 2.4.26 or later, which includes a fix that adds authenticated encryption support [2]. Red Hat Enterprise Linux users can apply the updated httpd packages provided in RHSA-2017:0906 and RHSA-2017:1161 [1][4]. Apple macOS users received the fix in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan [3].