CVE-2014-8567
HighSummary
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Risk Assessment
Attackers can cause server crashes, resulting in service availability interruptions for users.
Recommendation
It is recommended to update the mod_auth_mellon module to version 0.8.1 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in mod_auth_mellon
See all- CVE-2016-2146High
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not limit the amount of data read, allowing remote attackers to cause a denial of service via a large amount of POST data.
- CVE-2016-2145High
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not check if the ap_get_client_block function returns an error, allowing remote attackers to cause a denial of service (segmentation fault and process crash) via crafted POST data.
Original NVD description (English source)
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.