Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Apache Update: TLS Certificate Authentication Bypass with HTTP/2 (CVE-2016-4979)

Apache released an important update today to fix a vulnerability that affects servers that have http/2 enabled and use TLS client certificates for authentication.

Apache 2.4.18-20 are vulnerable if:

- TLS certificates are used for authenticating clients (look for the "SSLVerifyClient require" directive in your configuration file)

- http/2 is enabled. (see if the "Protocols" line includes h2 and/or h2c). 

Only access over http/2 is affected. Access via http/1.1 is still properly controlled even if http/2 is enabled. Over TLS, clients that suport http/2 will likely use it over http/1.1.

http/2 is not enabled by default in any currently shipping version of Apache.

To quickly check your network traffic for http/2 use, you can use this tshark line:

tshark -Y 'ssl.handshake.extensions_alpn_str == "h2"' -n -i en0  \
-T fields -e ip.src -e ip.dst -e ssl.handshake.type -e ssl.handshake.extensions_server_name \
-e ssl.handshake.extensions_alpn_str

It will list the client requests as well as the server responses that contain http/2 including the host name that the client is trying to reach. For example:    1    h2,spdy/3.1,http/1.1    2        h2

In this handshake, the client offers http/2, spdy/3.1 as well as http/1.1 to . The server then selects http/2 (h2).



Johannes B. Ullrich, Ph.D.

I will be teaching next: Intrusion Detection In-Depth - SANS Doha March 2022


4350 Posts
ISC Handler
Jul 5th 2016
Hello mate,

I tried to run your command and get errors.
When trying the tshark command.

tshark -Y 'ssl.handshake.extensions_alpn_str == "h2"' -n -i en0 \
-T fields -e ip.src -e ip.dst -e ssl.handshake.type -e ssl.handshake.extensions_server_name \
-e ssl.handshake.extensions_alpn_str

I get "That string isn't a valid capture filter (Syntax error).
See the User's Guide for a description of the capture filter syntax.
0 packets captured.

Do you know how to fix this? Pretty new to the game yet but love learning.

Also, is there a Snort rule that can be used to find this?

Thanks again. Love the show and love the news update.
Try a newer version of tshark.

I know the one I had in my Ubuntu 14.04 didn't "ssl.handshake.extensions_alpn_str" part at all, it's only newer versions of tshark that supports that extension.

PS. Ubuntu 16.04 has a working version.

Sign Up for Free or Log In to start participating in the conversation!