From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 4 Mar 2007 16:30:45 +0200
Subject: [NEWS] Apache Tomcat JK Web Server Connector Long URL Stack Overflow
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20070304141306.38ACB5816@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Apache Tomcat JK Web Server Connector Long URL Stack Overflow
------------------------------------------------------------------------
SUMMARY
Apache <http://tomcat.apache.org/>; Tomcat is the servlet container that
is used in the official Reference Implementation for the Java Servlet and
JavaServer Pages technologies.
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apache Tomcat JK Web Server Connector.
Authentication is not required to exploit this vulnerability.
DETAILS
Affected Products:
* Tomcat JK Web Server Connector 1.2.19
* Tomcat JK Web Server Connector 1.2.20
* Tomcat 4.1.34
* Tomcat 5.5.20
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apache Tomcat JK Web Server Connector.
Authentication is not required to exploit this vulnerability.
The specific flaw exists in the URI handler for the mod_jk.so library,
map_uri_to_worker(), defined in native/common/jk_uri_worker_map.c. When
parsing a long URL request, the URI worker map routine performs an unsafe
memory copy. This results in a stack overflow condition which can be
leveraged to execute arbitrary code.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774>;
CVE-2007-0774
Disclosure Timeline:
* 2007.02.16 - Vulnerability reported to vendor
* 2007.02.26 - Digital Vaccine released to TippingPoint customers
* 2007.03.02 - Coordinated public release of advisory
ADDITIONAL INFORMATION
The information has been provided by Zero Day Initiative (ZDI).
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-07-008.html>;
http://www.zerodayinitiative.com/advisories/ZDI-07-008.html
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
