CVE-2016-2145: Input Validation
Published Apr 15, 2016
·Updated
The amreadpostdata function in modauthmellon before 0.11.1 does not check if the apgetclientblock function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
Affected Software
2 affected components
Fedoraproject Fedora=23
Uninett Mod Auth Mellon<=0.11.0
Remediation
Patch Available
Event History
Apr 15, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2145?
CVE-2016-2145 is classified as a denial of service vulnerability due to potential process crashes from malformed POST data.
2
How do I fix CVE-2016-2145?
To address CVE-2016-2145, upgrade mod_auth_mellon to version 0.11.1 or later.
3
Which versions of mod_auth_mellon are affected by CVE-2016-2145?
CVE-2016-2145 affects mod_auth_mellon versions up to and including 0.11.0.
4
What software is impacted by CVE-2016-2145?
CVE-2016-2145 impacts Fedora 23 and versions of mod_auth_mellon prior to 0.11.1.
5
What can attackers do exploiting CVE-2016-2145?
Exploiting CVE-2016-2145 allows attackers to cause a denial of service by crafting specific POST data that leads to a segmentation fault.