drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Pufferüberlauf in mod_jk
Name: |
Pufferüberlauf in mod_jk |
|
ID: |
200703-16 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Sa, 17. März 2007, 00:15 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774 |
|
Applikationen: |
mod_jk |
|
Originalnachricht |
--Bqc0IY4JZZt50bUr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200703-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High Title: Apache JK Tomcat Connector: Remote execution of arbitrary code Date: March 16, 2007 Bugs: #169433 ID: 200703-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
The Apache Tomcat Connector (mod_jk) contains a buffer overflow vulnerability that could result in the remote execution of arbitrary code.
Background ==========
The Apache HTTP server is a very widely used web server. mod_jk provides the JK module for connecting Tomcat and Apache using the ajp13 protocol.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apache/mod_jk < 1.2.21-r1 >= 1.2.21-r1
Description ===========
ZDI reported an unsafe memory copy in mod_jk that was discovered by an anonymous researcher in the map_uri_to_worker function of native/common/jk_uri_worker_map.c .
Impact ======
A remote attacker can send a long URL request to an Apache server using Tomcat. That can trigger the vulnerability and lead to a stack-based buffer overflow, which could result in the execution of arbitrary code with the permissions of the Apache user.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All Apache Tomcat users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.21-r1"
References ==========
[ 1 ] CVE-2007-0774 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200703-16.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--Bqc0IY4JZZt50bUr Content-Type: application/pgp-signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBRfsdCjvRww8BFPxFAQKDIwf+O7B5MPqqX6xlRFLO8a2WWLyVUIoNFvzC US14UNvRvsXaG4l4GsT1CeDbn6RdAHoQqff4ccPiyLIBSV6/sfKaVC9cH+OK8DON +uVQAv5QBNNLJFh61aLzrGRcH8vJbTRIy3G7vO+d/A5AI8ZqF0RyGuWx0t0kq83p +5zlujHyyCPcMPmLKIDQKSeIy22dilvx8BLCLLvlECQhxWd4Civgpb6zxjJYABtx DttD2zNH+uAry7R1NSC4y9mc0zw7HT0RJRdEVZawr4tBxRGGiUm5Lq1ihkqGKGK0 mFiPEwjkdUJ2aRnhPOnlsjCBe3Mtp/8Z2OH03wpbVuCGEr82QcigTw== =lGJJ -----END PGP SIGNATURE-----
--Bqc0IY4JZZt50bUr-- -- gentoo-announce@gentoo.org mailing list
|
|
|
|