CVE-2017-9788

What it actually does

Uninitialized or stale memory from prior requests in mod_auth_digest can be reflected in Digest Authorization header responses or trigger a segmentation fault leading to denial of service.

Why it matters to the business

Attackers may obtain sensitive configuration or credential fragments from server memory or cause service outages; the issue affects widely deployed web servers with many downstream dependents and has remained exploitable for years without widespread patching.

How an attack unfolds

An attacker sends repeated HTTP requests containing specially crafted Digest Authorization or Proxy-Authorization headers that include an initial key without an equals sign; the server responds with leaked uninitialized pool memory contents or crashes.

How to fix it

Upgrade Apache httpd to version 2.2.34 or 2.4.27 or later; apply the exact fixed packages listed for affected distributions where qemu packages were erroneously referenced in source data.

How to confirm the fix worked

Confirm the httpd binary or package version is at or above the fixed releases; test with crafted Digest headers to verify absence of memory disclosure or crashes.

Typical attack path

1. Identify target Apache httpd servers running versions prior to 2.2.34 or 2.4.27 with mod_auth_digest enabled
2. Craft HTTP requests containing Digest Authorization headers with a leading key and no '=' assignment
3. Send multiple successive requests to trigger reuse of uninitialized memory across requests
4. Inspect responses for leaked confidential data or observe service crashes resulting in denial of service

How to detect it

Review web server access logs for repeated Digest Authorization headers containing keys without equals signs; inspect crash dumps or memory logs for signs of uninitialized data leakage; correlate with mod_auth_digest module activity.

• Authorization: Digest [key without =]
• Proxy-Authorization: Digest [key without =]
• segfault in mod_auth_digest
• httpd process crash after Digest header processing

What your security team should do

• Immediately upgrade all Apache httpd instances to the fixed versions 2.2.34 or 2.4.27
• Disable mod_auth_digest if Digest authentication is not required
• Monitor for unexpected crashes or anomalous Authorization header traffic
• Prioritize patching given the high CVSS, stable EPSS, and long window since publication