Vulnerability Name:

CVE-2014-8567 (CCN-98467)

Assigned:2014-11-03
Published:2014-11-03
Updated:2019-07-09
Summary:The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:9.4 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:C)
7.0 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): Complete
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2014-8567

Source: CONFIRM
Type: Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1803.html

Source: CCN
Type: RHSA-2014-1803
Important: mod_auth_mellon security update

Source: REDHAT
Type: Third Party Advisory
RHSA-2014:1803

Source: CCN
Type: oss-security Mailing List, Tue, 04 Nov 2014 12:53:43 +1100
CVE-2014-8566 and CVE-2014-8567: mod_auth_mellon issues affecting users of 0.8.0

Source: SECUNIA
Type: Permissions Required, Third Party Advisory
62094

Source: SECUNIA
Type: Permissions Required, Third Party Advisory
62125

Source: CCN
Type: BID-70896
mod_auth_mellon CVE-2014-8567 Denial of Service Vulnerability

Source: CCN
Type: Red Hat Bugzilla Bug 1157954
(CVE-2014-8567) CVE-2014-8567 mod_auth_mellon: logout processing leads to denial of service

Source: XF
Type: UNKNOWN
modauthmellon-cve20148567-dos(98467)

Source: CCN
Type: mod_auth_mellon Web page
mod_auth_mellon

Source: CONFIRM
Type: Third Party Advisory
https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647

Source: MLIST
Type: Vendor Advisory
[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-8567

Vulnerable Configuration:Configuration 1:
  • cpe:/a:uninett:mod_auth_mellon:*:*:*:*:*:*:*:* (Version < 0.8.1)

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mod_auth_mellon_project:mod_auth_mellon:0.9.0:*:*:*:*:apache:*:*
  • OR cpe:/a:mod_auth_mellon_project:mod_auth_mellon:0.9.1:*:*:*:*:apache:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux_server:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:28374
    P
    		RHSA-2014:1803 -- mod_auth_mellon security update (Important)
    2015-01-26
    oval:org.mitre.oval:def:28281
    P
    		ELSA-2014-1803 -- mod_auth_mellon security update (important)
    2014-12-29
    oval:com.ubuntu.disco:def:201485670000000
    V
    		CVE-2014-8567 on Ubuntu 19.04 (disco) - medium.
    2014-11-14
    oval:com.ubuntu.trusty:def:20148567000
    V
    		CVE-2014-8567 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-11-14
    oval:com.ubuntu.cosmic:def:201485670000000
    V
    		CVE-2014-8567 on Ubuntu 18.10 (cosmic) - medium.
    2014-11-14
    oval:com.ubuntu.artful:def:20148567000
    V
    		CVE-2014-8567 on Ubuntu 17.10 (artful) - medium.
    2014-11-14
    oval:com.ubuntu.xenial:def:20148567000
    V
    		CVE-2014-8567 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-11-14
    oval:com.ubuntu.bionic:def:201485670000000
    V
    		CVE-2014-8567 on Ubuntu 18.04 LTS (bionic) - medium.
    2014-11-14
    oval:com.ubuntu.bionic:def:20148567000
    V
    		CVE-2014-8567 on Ubuntu 18.04 LTS (bionic) - medium.
    2014-11-14
    oval:com.ubuntu.xenial:def:201485670000000
    V
    		CVE-2014-8567 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-11-14
    oval:com.ubuntu.cosmic:def:20148567000
    V
    		CVE-2014-8567 on Ubuntu 18.10 (cosmic) - medium.
    2014-11-14
    oval:com.redhat.rhsa:def:20141803
    P
    		RHSA-2014:1803: mod_auth_mellon security update (Important)
    2014-11-05
    BACK
    uninett mod auth mellon *
    redhat enterprise linux desktop 6.0
    redhat enterprise linux server 6.0
    redhat enterprise linux server aus 6.6
    redhat enterprise linux server eus 6.6
    redhat enterprise linux server tus 6.6
    redhat enterprise linux workstation 6.0
    mod_auth_mellon_project mod auth mellon 0.9.0
    mod_auth_mellon_project mod auth mellon 0.9.1
    redhat enterprise linux server 6
    redhat enterprise linux workstation 6