Buffer overflow in Apache Mod Jk

CVE-2007-6258

Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.

Vulnerability class: Buffer Overflow

EPSS: 0.415 (98.5th percentile) — read the EPSS interpretation.

Affected products

Apache Mod_jk — versions 2.0, 2.0.1, 2.0.2
F5 Big-ip — versions 9.2.3.30
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cret@cert.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
cret@cert.org (URL Repurposed, vdb-entry, x_refsource_VUPEN)
cret@cert.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cret@cert.org (Third Party Advisory, x_refsource_MISC)
cret@cert.org (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
cret@cert.org (x_refsource_SREASON, Broken Link, third-party-advisory)
cret@cert.org (US Government Resource, x_refsource_CERT-VN, Patch, Third Party Advisory, third-party-advisory)
cret@cert.org (x_refsource_MISC, Broken Link)
cret@cert.org (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)