diff options
| author | Simon L. B. Nielsen <simon@FreeBSD.org> | 2007-03-05 23:17:51 +0000 |
|---|---|---|
| committer | Simon L. B. Nielsen <simon@FreeBSD.org> | 2007-03-05 23:17:51 +0000 |
| commit | e247fea80eb2dce2e7e7652332cfe1057716cabd (patch) | |
| tree | 110bcad3f62190a328ab7e5c171cc45e603c5642 /security/vuxml | |
| parent | - Update to R29 (diff) | |
Document mod_jk -- long URL stack overflow vulnerability.
Notes
Notes:
svn path=/head/; revision=186607
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f35a2dac1551..0f098359e7e6 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,43 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9"> + <topic>mod_jk -- long URL stack overflow vulnerability</topic> + <affects> + <package> + <name>mod_jk-ap2</name> + <name>mod_jk</name> + <range><ge>1.2.19</ge><lt>1.2.22</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>TippingPoint and The Zero Day Initiative reports:</p> + <blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html"> + <p>This vulnerability allows remote attackers to execute + arbitrary code on vulnerable installations of Apache + Tomcat JK Web Server Connector. Authentication is not + required to exploit this vulnerability.</p> + <p>The specific flaw exists in the URI handler for the + mod_jk.so library, map_uri_to_worker(), defined in + native/common/jk_uri_worker_map.c. When parsing a long URL + request, the URI worker map routine performs an unsafe + memory copy. This results in a stack overflow condition + which can be leveraged to execute arbitrary code.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2007-0774</cvename> + <url>http://tomcat.apache.org/security-jk.html</url> + <url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url> + </references> + <dates> + <discovery>2007-03-02</discovery> + <entry>2007-03-05</entry> + </dates> + </vuln> + <vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a"> <topic>bind -- Multiple Denial of Service vulnerabilities</topic> <affects> |