Vulnerabilities in Apache 2.4.67 And Older on Siteminder Access Gateway 12.9
Article ID: 447558
Updated On:
Products
Issue/Introduction
Siteminder Access Gateway ships bundled with an instance of Apache HTTP Server. The following is a list of Apache HTTP Server versions by Siteminder Access Gateway version:
Access Gateway r12.9: Apache HTTP Server 2.4.63
KB407918 (archived) delivered Apache HTTP Server 2.4.65
KB422058 (archived) delivered Apache HTTP Server 2.4.66
A number of Common Vulnerabilities and Exposures (CVE's) published for Apache HTTPS Server 2.4.67 and older. These CVE's are remediated in Apache HTTP Server 2.4.68.
NOTE: This KB applies to Siteminder Access Gateway r12.9 ONLY
Environment
PRODUCT: Symantec Siteminder
COMPONENT: Access Gateway Server
VERSION: r12.9 (only)
OPERATING SYSTEM: ANY
Cause
The following CVE's have been published for Apache HTTP Server 2.4.67 and older for Access Gateway:
CVE-2026-29167: mod_ldap per-dir use-after-free
SEVERITY: Low
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-29170: mod_proxy_ftp XSS
SEVERITY: Low
A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.
IMPACTED: through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-34355: mod_proxy_html buffer overflow
SEVERITY: moderate
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-34356: ProxyPassReverseCookieMap buffer overflow
SEVERITY: Low
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-42535: mod_dav_fs protected directory access
SEVERITY: moderate
A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.
IMPACTED: through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-42536: mod_xml2enc heap overflow
SEVERITY: Low
DESRCRIPTION: Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-43951: OOB Read in merge_response_headers can cause crash
SEVERITY: moderate
DESRCRIPTION: Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-44119: escalation of privilege through expressions in .htaccess in multiple modules
SEVERITY: moderate
DESRCRIPTION: Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request
SEVERITY: Low
DESRCRIPTION: Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-44186: Loop in proxy_ftp_handler in mod_proxy_ftp
SEVERITY: moderate
DESRCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-44631: Heap Underflow in ap_regname via Signed Char Overflow
SEVERITY: Low
DESRCRIPTION: Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration.
IMPACTED: 2.4.0 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-48913: mod_http2 memory corruption when file handles exhausted
SEVERITY: moderate
DESRCRIPTION: Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.
IMPACTED: 2.4.55 through 2.4.67
REMEDIATED: Apache 2.4.68
CVE-2026-49975: mod_http2 denial of service
SEVERITY: moderate
DESRCRIPTION: Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
IMPACTED: 2.4.17 through 2.4.67
REMEDIATED: Apache 2.4.68
Resolution
Upgrade Apache on Siteminder Access Gateway 12.9 to Apache HTTP Server 2.4.68 using this KB. Apache HTTP Server 2.4.68 for Siteminder Access Gateway 12.9 is attached to this KB.
NOTE: This KB provides Apache HTTP Server 2.4.68 for Access Gateway Servers r12.9 ONLY. This KB is not to be used for Siteminder Access Gateway r12.8.8.1 or older
Siteminder Access Gateway r12.8.8.1 and older shipped with Apache HTTP Server 2.4.x as well, however that version of Apache HTTP Server is compiled with OpenSSL 1.0.2, while Apache in Siteminder Access Gateway 12.9 is compiled with OpenSSL 3.0.x. The Apache HTTP Server binaries for r12.8.8.x and r12.9 are not interchangeable. This KB applies to Siteminder Access Gateway r12.9 ONLY.
How to Verify the version of Apache HTTP Server Installed on Siteminder Access Gateway
WINDOWS
1. Stop the running Access Gateway Server
2. Using File Explorer, navigate to the Access Gateway installation directory
Default: <Install_Dir>\CA\secure-proxy\
3. Back-up the original '\httpd' directory <httpd_orig>
<Install_Dir>\CA\secure-proxy\httpd
4. Unzip the attached "httpd_2468_win64_129GA.zip" and copy the 'httpd' folder to <Install_Dir>\CA\secure-proxy\
5. Copy the the '\conf' directory from the original "<httpd_orig>\conf" into <Install_Dir>\CA\secure-proxy\httpd\
6. Copy the the 'configssl.bat' file from the original "<httpd_orig>\bin" into <Install_Dir>\CA\secure-proxy\httpd\bin
8. Upgrade to OpenSSL 3.5.7 as per KB 447372: OpenSSL 3.5.6 and older Vulnerabilities on Siteminder Access Gateway r12.9
9. Start the Access Gateway Server.
LINUX
1. Stop the running Access Gateway Server
2. Navigate to the Access Gateway installation directory
Default: <Install_Dir>/CA/secure-proxy/
3. Back-up the original '/httpd' directory <httpd_orig>
<Install_Dir>/CA/secure-proxy/httpd
EXAMPLE: cp -R <Install_Dir>/CA/secure-proxy/httpd/ <Install_Dir>/CA/secure-proxy/httpd_orig/
4. Unzip the attached 'httpd_2468_linux_129GA.zip' file and copy the '/httpd' folder to <Install_Dir>/CA/secure-proxy/
5. Copy the following files from the original <httpd_orig> into <Install_Dir>/CA/secure-proxy/httpd/
cp -r httpd_orig/conf httpd/
cp httpd_orig/bin/apachectl httpd/bin/
cp httpd_orig/bin/apr-1-config httpd/bin/
cp httpd_orig/bin/apu-1-config httpd/bin/
cp httpd_orig/bin/apxs httpd/bin/
cp httpd_orig/bin/envvars httpd/bin/
cp httpd_orig/bin/envvars-std httpd/bin/
6. Upgrade to OpenSSL 3.5.7 as per KB 447372: OpenSSL 3.5.6 and older Vulnerabilities on Siteminder Access Gateway r12.9
7. Start the Access Gateway Server.
Additional Information
How to Verify the version of Apache HTTP Server Installed on Siteminder Access Gateway
KB 447372: OpenSSL 3.5.6 and older Vulnerabilities on Siteminder Access Gateway r12.9
Apache HTTP Server 2.4 vulnerabilities
Apache HTTP Server 2.4.68 remediates the following vulnerabilities:
CVE-2026-29167
CVE-2026-29170
CVE-2026-34355
CVE-2026-34356
CVE-2026-42535
CVE-2026-42536
CVE-2026-43951
CVE-2026-44119
CVE-2026-44185
CVE-2026-44186
CVE-2026-44631
CVE-2026-48913
CVE-2026-49975
CVE-2026-23918
CVE-2026-24072
CVE-2026-28780
CVE-2026-29168
CVE-2026-29169
CVE-2026-33006
CVE-2026-33007
CVE-2026-33523
CVE-2026-33857
CVE-2026-34032
CVE-2026-34059
CVE-2025-55753
CVE-2025-58098
CVE-2025-59775
CVE-2025-65082
CVE-2025-66200
CVE-2025-54090
CVE-2024-42516
CVE-2024-43204
CVE-2024-43394
CVE-2024-47252
CVE-2025-23048
CVE-2025-49630
CVE-2024-49812
CVE-2024-40898
CVE-2024-40725
CVE-2024-40898
CVE-2023-38709
CVE-2024-36387
CVE-2024-24795
CVE-2024-27316
CVE-2023-31122
CVE-2023-43622
CVE-2023-45802
CVE-2023-25690
CVE-2023-27522
CVE-2006-20001
CVE-2022-36760
CVE-2022-37436
Attachments
Feedback
