|
Description
|
|
A vulnerability has been identified in Apache Tomcat Connector, which could be exploited by attackers to compromise a vulnerable web server. This issue is due to a buffer overflow error in the mod_jk library when processing overly long URLs via the "map_uri_to_worker()" [native/common/jk_uri_worker_map.c] method, which could be exploited by remote attackers to execute arbitrary commands by sending a specially crafted request to an affected server.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
Apache Tomcat Connector (mod_jk) version 1.2.20Apache Tomcat Connector (mod_jk) version 1.2.19Apache Tomcat version 4.1.34Apache Tomcat version 5.5.20
|
|
|
|
|
|
Solution
|
|
Upgrade to mod_jk version 1.2.21 :
http://tomcat.apache.org/download-connectors.cgi
|
|
|
|
|
|
CVE
|
|
CVE-2007-0774
|
|
|
|
|
|
References
|
|
http://tomcat.apache.org/security-jk.html
http://www.zerodayinitiative.com/advisories/ZDI-07-008.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
Yes (since ASQ v3.5.0)
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
