Bug 1387605 (CVE-2016-8612) - CVE-2016-8612 JBCS mod_cluster: Protocol parsing logic error
Summary: CVE-2016-8612 JBCS mod_cluster: Protocol parsing logic error
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-8612
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1387613 1387623 1387624
Blocks: 1387606 1395463
TreeView+ depends on / blocked
 
Reported: 2016-10-21 11:14 UTC by Andrej Nemec
Modified: 2021-10-21 00:55 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An error was found in protocol parsing logic of mod_cluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process.
Clone Of:
Environment:
Last Closed: 2021-10-21 00:55:41 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2957 0 normal SHIPPED_LIVE Important: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release 2016-12-16 03:11:19 UTC
Red Hat Product Errata RHSA-2017:0193 0 normal SHIPPED_LIVE Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6 2017-01-26 01:05:09 UTC
Red Hat Product Errata RHSA-2017:0194 0 normal SHIPPED_LIVE Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7 2017-01-26 01:04:50 UTC

Description Andrej Nemec 2016-10-21 11:14:29 UTC 
There is an error in protocol parsing logic of mod_cluster load balancer Apache HTTP Server modules that allows attacker to cause a Segmentation Fault in the serving httpd process. The vector is mod_cluster service messages that are used by worker nodes to communicate their status, load and deployed applications to the mod_cluster balancer. With proper production configuration, the VirtualHost accepting these messages is accessible only from an internal network where worker nodes reside. The error cannot be exploited from the Internet by arbitrary clients.

Upstream bug:

https://issues.jboss.org/browse/JBCS-193
Comment 9 errata-xmlrpc 2016-12-15 22:12:39 UTC 
This issue has been addressed in the following products:



Via RHSA-2016:2957 https://rhn.redhat.com/errata/RHSA-2016-2957.html
Comment 10 errata-xmlrpc 2017-01-25 20:06:46 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7

Via RHSA-2017:0194 https://access.redhat.com/errata/RHSA-2017:0194
Comment 11 errata-xmlrpc 2017-01-25 20:08:06 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6

Via RHSA-2017:0193 https://access.redhat.com/errata/RHSA-2017:0193
Note You need to log in before you can comment on or make changes to this bug.