{"id":7642,"date":"2018-01-05T01:51:35","date_gmt":"2018-01-05T01:51:35","guid":{"rendered":"http:\/\/blog.nsfocusglobal.com\/?p=1076"},"modified":"2025-07-09T07:15:10","modified_gmt":"2025-07-09T07:15:10","slug":"technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/","title":{"rendered":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562)"},"content":{"rendered":"<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead.png\"><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full wp-image-1081\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead.png\" alt=\"\" width=\"595\" height=\"253\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead.png 595w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-300x128.png 300w\" sizes=\"(max-width: 595px) 100vw, 595px\" \/><\/a><\/p>\n<p>A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters, and will affect all users who have CGI support enabled with dynamically linked executables (CGI scripts). This behavior, when combined with the glibc dynamic linker, can be abused for remote code execution using special variables such as LD_PRELOAD.<\/p>\n<p>Reference links:<\/p>\n<p><a href=\"https:\/\/www.elttam.com.au\/blog\/goahead\/\">https:\/\/www.elttam.com.au\/blog\/goahead\/<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/embedthis\/goahead\/issues\/249\">https:\/\/github.com\/embedthis\/goahead\/issues\/249<\/a><\/p>\n<h2>Affected Versions<\/h2>\n<p>\uf06c\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 GoAhead Web Server Version &lt; 3.6.5<\/p>\n<h2><strong>Unaffected Versions<\/strong><\/h2>\n<p>\uf06c\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0GoAhead Web Server Version &gt;= 3.6.5<\/p>\n<h2>Solutions<\/h2>\n<h3><strong>Users\u2019 Self-Inspection<\/strong><\/h3>\n<p>This vulnerability has impact on users who have enabled dynamically linked executables on Linux server. Besides, users should check their GoAhead Web Server version to see if it is affected. If it\u2019s earlier than version 3.6.5, risk exists.<\/p>\n<p>The following commands can be used to check the version:<\/p>\n<table style=\"height: 50px\" width=\"557\">\n<tbody>\n<tr>\n<td width=\"561\">.\/goahead &#8211;version<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Check-versions.png\"><img decoding=\"async\" class=\"alignnone size-full wp-image-1077\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Check-versions.png\" alt=\"\" width=\"718\" height=\"62\" \/><\/a><\/p>\n<h3><strong>Patches from Vendor<\/strong><\/h3>\n<p>The vendor has released patches to fix this issue in its new version. Users are advised to upgrade immediately by saving and applying auth.txt and route.txt files to the new version.<\/p>\n<p>Reference links:<\/p>\n<p><a href=\"https:\/\/embedthis.com\/goahead\/download.html\">https:\/\/embedthis.com\/goahead\/download.html<\/a><\/p>\n<p><a href=\"https:\/\/embedthis.com\/goahead\/doc\/start\/installing.html\">https:\/\/embedthis.com\/goahead\/doc\/start\/installing.html<\/a><\/p>\n<h3><strong>Recommended Solution from NSFOCUS<\/strong><\/h3>\n<p>Using NSFOCUS detection products and service<\/p>\n<ol>\n<li>Use NSFOCUS Cloud to get quick online detection for public assets, available at the following link: <a href=\"https:\/\/cloud.nsfocus.com\/#\/krosa\/views\/initcdr\/productandservice?page_id=12\">https:\/\/cloud.nsfocus.com\/#\/krosa\/views\/initcdr\/productandservice?page_id=12<\/a><\/li>\n<li>Use NSFOCUS Intrusion Detection System (IDS) to detect intranet assets. Find the latest patch at the following link and carry out the detection. <a href=\"http:\/\/update.nsfocus.com\/update\/listIds\">http:\/\/update.nsfocus.com\/update\/listIds<\/a><\/li>\n<\/ol>\n<p>Using NSFOCUS prevention products<\/p>\n<ul>\n<li>Intrusion prevention system (IPS)<\/li>\n<\/ul>\n<p><a href=\"http:\/\/update.nsfocus.com\/update\/listIps\">http:\/\/update.nsfocus.com\/update\/listIps<\/a><\/p>\n<ul>\n<li>Next-generation Firewall (NF)<\/li>\n<\/ul>\n<p><a href=\"http:\/\/update.nsfocus.com\/update\/listNf\">http:\/\/update.nsfocus.com\/update\/listNf<\/a><\/p>\n<ul>\n<li>Web Application Firewall (WAF)<\/li>\n<\/ul>\n<p><a href=\"http:\/\/update.nsfocus.com\/update\/wafIndex\">http:\/\/update.nsfocus.com\/update\/wafIndex<\/a><\/p>\n<p>Please update to the latest version for immediate protection.<\/p>\n<h2><strong>Technical Analysis <\/strong><\/h2>\n<p>GoAhead CGI process cannot filter parameters correctly when handling HTTP requests. It can be employed to inject variable LD_PRELOAD and bring RCE risk.<\/p>\n<p>Function cgihandler of goahead\/src\/cgi.c is used to handle HTTP requests:<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Function-cgihandler.png\"><img decoding=\"async\" class=\"alignnone size-full wp-image-1080\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Function-cgihandler.png\" alt=\"\" width=\"846\" height=\"771\" \/><\/a><\/p>\n<p><strong>\u00a0<\/strong>It references key-values from HTTP request parameters and uses them in envp groups as environment variables to pass on to function launchCgi for CGI execution.<\/p>\n<p>Function launchCgi executes the mentioned-above environment variables as environment variables of CGI through execve.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/launchCgi.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1082\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/launchCgi.png\" alt=\"\" width=\"674\" height=\"754\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/launchCgi.png 674w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/launchCgi-268x300.png 268w\" sizes=\"(max-width: 674px) 100vw, 674px\" \/><\/a><\/p>\n<p>On Linux system it is possible to use LD_PRELOAD environment variables to hook and hijack function execution flows, just as we\u2019ve known.<\/p>\n<p>We can see that only REMOTE_HOST and HTTP_AUTHORIZATION were filtered in the function.<\/p>\n<p>The parameters in HTTP requests are directly assigned to envp groups by \u201cenvp[n++] = sfmt(&#8220;%s=%s&#8221;, s-&gt;name.value.string, s-&gt;content.value.string);\u201d, and then the envp groups are used as environment variables in CGI process.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/environment-variables.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1078\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/environment-variables.png\" alt=\"\" width=\"663\" height=\"304\" \/><\/a><\/p>\n<p>That means a malicious HTTP request will make CGI execute designated shared object files.<\/p>\n<p><strong>Vulnerability Remediation <\/strong><\/p>\n<p>The vendor fixed this issue in June 2017 as shown on its official website.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-1083\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches-1024x171.png\" alt=\"\" width=\"640\" height=\"107\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches-1024x171.png 1024w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches-300x50.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches-768x128.png 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/Paches.png 1054w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>HTTP parameter filtering commands have been added in the patch to prevent unintended parameters from going into environment variables.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/filtering-commands.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1079\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/filtering-commands.png\" alt=\"\" width=\"834\" height=\"473\" \/><\/a><\/p>\n<p>In addition to \u201cLD_\u201d variables, characters like CDPATH and IFS are also in the filtering list.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters, and will affect all users who have CGI support enabled with dynamically linked executables (CGI scripts). This behavior, when combined with [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":35808,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3,6],"tags":[],"class_list":["post-7642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-emergency-response"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2018-01-05T01:51:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-09T07:15:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Technical Analysis and Recommended Solution of GoAhead httpd\\\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562)\",\"datePublished\":\"2018-01-05T01:51:35+00:00\",\"dateModified\":\"2025-07-09T07:15:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/\"},\"wordCount\":554,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/GoAhead-1.png\",\"articleSection\":[\"Blog\",\"Emergency Response\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/\",\"name\":\"Technical Analysis and Recommended Solution of GoAhead httpd\\\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/GoAhead-1.png\",\"datePublished\":\"2018-01-05T01:51:35+00:00\",\"dateModified\":\"2025-07-09T07:15:10+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/GoAhead-1.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/GoAhead-1.png\",\"width\":595,\"height\":253,\"caption\":\"GoAhead logo with embedded web server text.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Technical Analysis and Recommended Solution of GoAhead httpd\\\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"pt_BR","og_type":"article","og_title":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS","og_description":"A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of","og_url":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/","og_site_name":"NSFOCUS","article_published_time":"2018-01-05T01:51:35+00:00","article_modified_time":"2025-07-09T07:15:10+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_title":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS","twitter_description":"A remote RCE vulnerability (CVE-2017-17562) was found in all GoAhead Web Server\u2019s versions earlier than 3.6.5. The vulnerability is a result of","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","twitter_misc":{"Escrito por":"admin","Est. tempo de leitura":"3 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/"},"author":{"name":"admin","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562)","datePublished":"2018-01-05T01:51:35+00:00","dateModified":"2025-07-09T07:15:10+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/"},"wordCount":554,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","articleSection":["Blog","Emergency Response"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/","url":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/","name":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562) - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","datePublished":"2018-01-05T01:51:35+00:00","dateModified":"2025-07-09T07:15:10+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2018\/01\/GoAhead-1.png","width":595,"height":253,"caption":"GoAhead logo with embedded web server text."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/technical-analysis-and-recommended-solution-of-goahead-httpd-2-5-to-3-5-ld_preload-remote-code-execution-vulnerability-cve-2017-17562\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Technical Analysis and Recommended Solution of GoAhead httpd\/2.5 to 3.5 LD_PRELOAD Remote Code Execution Vulnerability (CVE-2017-17562)"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website","url":"https:\/\/nsfocusglobal.com\/pt-br\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/pt-br\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/pt-br\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"admin","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=7642"}],"version-history":[{"count":1,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7642\/revisions"}],"predecessor-version":[{"id":32645,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7642\/revisions\/32645"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/35808"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=7642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=7642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=7642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}