diff options
| author | simon <simon@FreeBSD.org> | 2007-03-06 07:17:51 +0800 |
|---|---|---|
| committer | simon <simon@FreeBSD.org> | 2007-03-06 07:17:51 +0800 |
| commit | e469352914eb0612df66fe5423ac717b782f7761 (patch) | |
| tree | ca9ef9282356b2baf7a406d75f5b9e8fa1d4e925 /security/vuxml | |
| parent | 27848ad40f147abe40660a91e56ffb1a8cd13b02 (diff) | |
| download | freebsd-ports-gnome-e469352914eb0612df66fe5423ac717b782f7761.tar.gz freebsd-ports-gnome-e469352914eb0612df66fe5423ac717b782f7761.tar.zst freebsd-ports-gnome-e469352914eb0612df66fe5423ac717b782f7761.zip | |
Document mod_jk -- long URL stack overflow vulnerability.
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f35a2dac1551..0f098359e7e6 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,43 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9"> + <topic>mod_jk -- long URL stack overflow vulnerability</topic> + <affects> + <package> + <name>mod_jk-ap2</name> + <name>mod_jk</name> + <range><ge>1.2.19</ge><lt>1.2.22</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>TippingPoint and The Zero Day Initiative reports:</p> + <blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html"> + <p>This vulnerability allows remote attackers to execute + arbitrary code on vulnerable installations of Apache + Tomcat JK Web Server Connector. Authentication is not + required to exploit this vulnerability.</p> + <p>The specific flaw exists in the URI handler for the + mod_jk.so library, map_uri_to_worker(), defined in + native/common/jk_uri_worker_map.c. When parsing a long URL + request, the URI worker map routine performs an unsafe + memory copy. This results in a stack overflow condition + which can be leveraged to execute arbitrary code.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2007-0774</cvename> + <url>http://tomcat.apache.org/security-jk.html</url> + <url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url> + </references> + <dates> + <discovery>2007-03-02</discovery> + <entry>2007-03-05</entry> + </dates> + </vuln> + <vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a"> <topic>bind -- Multiple Denial of Service vulnerabilities</topic> <affects> |