CVE-2014-8567 The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
HighCVSS 9.4
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libapache2-mod-auth-mellon(Debian:12) | < 0.9.0 | 0.9.0 |
| debian/libapache2-mod-auth-mellon(Debian:13) | < 0.9.0 | 0.9.0 |
| debian/libapache2-mod-auth-mellon(Debian:14) | < 0.9.0 | 0.9.0 |
| uninett mod auth mellon | < 0.8.1 | 0.8.1 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server eus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-8567 vendor-advisory
- linux.oracle.com third-party-advisory
- RHSA-2014:1803 third-party-advisory vendor-advisory
- 62094 permissions-required third-party-advisory
- 62125 permissions-required third-party-advisory
- github.com third-party-advisory
- [modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon mailing-list vendor-advisory