PT-2018-5032 · Apache+1 · Apache Http Server Mod Cluster+1

Andrej Nemec · Published 2016-08-23 · Updated 2023-02-12 · CVE-2016-8612

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Apache HTTP Server mod cluster versions prior to 2.4.23

Description The issue is related to an improper input validation in the protocol parsing logic of the load balancer, which can result in a segmentation fault in the serving httpd process.

Recommendations For versions prior to 2.4.23, update to version 2.4.23 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2016-1877

CVE-2016-8612

RHSA-2017:0193

RHSA-2017:0194

Affected Products

Alt Linux

Apache Http Server Mod Cluster

References · 15

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4979 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1546 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2957.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8612 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8612 · Security Note
• https://access.redhat.com/errata/RHSA-2017:0193 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01707 · Security Note
• https://access.redhat.com/errata/RHSA-2017:0194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8612 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2016-8612 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8612 · Note
• http://securityfocus.com/bid/94939 · Note
• https://security.netapp.com/advisory/ntap-20180601-0005 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1387605 · Note