CVE-2016-3110: Input Validation
It is possible to remotely Segfault Apache http server with a specially crafted string sent to the modcluster via service messages (MCMP).
Only the VirtualHost explicitly enabled by an administrator to receive service messages from worker nodes (Tomcat or EAP workers). Unless the administrator made a grave mistake in opening an unsecured modcluster management VirtualHost to the Internet without any authentication, it is impossible to exploit this bug from an untrusted client.
Special set of modcluster management protocol HTTP method requests. One could pass a certain number of = symbols in sequence after a legitimate element and cause segfault.
Other sources
modcluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3110?
CVE-2016-3110 is a vulnerability that can lead to a segmentation fault in the Apache http server.
How do I fix CVE-2016-3110?
To mitigate CVE-2016-3110, ensure that your server's VirtualHost is not configured to accept service messages from worker nodes.
Who is affected by CVE-2016-3110?
CVE-2016-3110 affects the Red Hat JBoss Enterprise Application Platform versions 6.0.0 and 6.4.0, as well as JBoss Enterprise Web Server versions 2.0.0 and 2.1.
Can CVE-2016-3110 be exploited remotely?
Yes, CVE-2016-3110 can be exploited remotely with a specially crafted string sent to mod_cluster.
What versions of software are vulnerable to CVE-2016-3110?
The vulnerable versions include JBoss Enterprise Application Platform 6.0.0, 6.4.0 and JBoss Enterprise Web Server 2.0.0, 2.1.