CVE-2016-2145
HighSummary
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not check if the ap_get_client_block function returns an error, allowing remote attackers to cause a denial of service (segmentation fault and process crash) via crafted POST data.
Risk Assessment
Attackers can exploit this vulnerability to remotely trigger a denial of service, potentially leading to application downtime and loss of availability.
Recommendation
It is recommended to update mod_auth_mellon to version 0.11.1 or later to mitigate this vulnerability.
Other vulnerabilities in mod_auth_mellon
See all- CVE-2016-2146High
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not limit the amount of data read, allowing remote attackers to cause a denial of service via a large amount of POST data.
- CVE-2014-8567High
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Original NVD description (English source)
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.