SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
(Red Hat Issues Fix for mod_jk) Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017721
SecurityTracker URL:  http://securitytracker.com/id/1017721
CVE Reference:   CVE-2007-0774   (Links to External Site)
Date:  Mar 2 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Tomcat JK Web Server Connector 1.2.19, 1.2.20 only; included in Tomcat 4.1.34, 5.5.20
Description:   A vulnerability was reported in Apache Tomcat JK Web Server Connector. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted URL that is longer than 4095 characters to trigger a stack overflow in the map_uri_to_worker() function in the 'mod_jk.so' library and execute arbitrary code on the target system. The code will run with the privileges of the target service.

Only versions 1.2.19 and 1.2.20 of the Apache Tomcat JK Web Server Connector are affected.

The vendor was notified on February 16, 2007.

TippingPoint disclosed this vulnerability.

The original advisory is available at:

http://www.zerodayinitiative.com/advisories/ZDI-07-008.html

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   Red Hat has released a fix for mod_jk on Red Hat Application Stack.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2007-0096.html

Vendor URL:  tomcat.apache.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  4

Message History:   This archive entry is a follow-up to the message listed below.
Mar 2 2007 Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [RHSA-2007:0096-01] Critical: mod_jk security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Critical: mod_jk security update
Advisory ID:       RHSA-2007:0096-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0096.html
Issue date:        2007-03-02
Updated on:        2007-03-02
Product:           Red Hat Application Stack
CVE Names:         CVE-2007-0774 
- ---------------------------------------------------------------------

1. Summary:

Updated mod_jk packages that fix a security issue are now available for Red
Hat Application Stack v1.1.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Application Stack v1 for Enterprise Linux AS (v.4) - i386, x86_64
Red Hat Application Stack v1 for Enterprise Linux ES (v.4) - i386, x86_64

3. Problem description:

mod_jk is a Tomcat connector that can be used to communicate between Tomcat
and the Apache HTTP Server 2. mod_jk was first distributed with Red Hat
Application Stack version 1.1 released on 19 February 2007.

A stack overflow flaw was found in the URI handler of mod_jk. A remote
attacker could visit a carefully crafted URL being handled by mod_jk and
trigger this flaw, which could lead to the execution of arbitrary code as the
'apache' user. (CVE-2007-0774)

Users of mod_jk should upgrade to these updated packages, which contain a
backported patch to correct this issue.

Red Hat would like to thank TippingPoint and the Zero Day Initiative for
reporting this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

230045 - CVE-2007-0774 mod_jk overflow flaw

6. RPMs required:

Red Hat Application Stack v1 for Enterprise Linux AS (v.4):

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/mod_jk-1.2.20-1.el4s1.2.src.rpm
53cfc442eaf404f5ff6e9d3ac8b65d9d  mod_jk-1.2.20-1.el4s1.2.src.rpm

i386:
40a1276add3a9336b4391f46279f2ce5  mod_jk-ap20-1.2.20-1.el4s1.2.i386.rpm
601454f1c882149aaf10f4ec87278876  mod_jk-debuginfo-1.2.20-1.el4s1.2.i386.rpm
69eba1ce187bcb64adc400af5836e8c7  mod_jk-manual-1.2.20-1.el4s1.2.i386.rpm

x86_64:
f59150fc0501348d6031cea0b1df2eb1  mod_jk-ap20-1.2.20-1.el4s1.2.x86_64.rpm
4f6214772bb4a0412ccc892b3e052413  mod_jk-debuginfo-1.2.20-1.el4s1.2.x86_64.rpm
68a22cc1317cb05d979d29a2f5288ed3  mod_jk-manual-1.2.20-1.el4s1.2.x86_64.rpm

Red Hat Application Stack v1 for Enterprise Linux ES (v.4):

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/mod_jk-1.2.20-1.el4s1.2.src.rpm
53cfc442eaf404f5ff6e9d3ac8b65d9d  mod_jk-1.2.20-1.el4s1.2.src.rpm

i386:
40a1276add3a9336b4391f46279f2ce5  mod_jk-ap20-1.2.20-1.el4s1.2.i386.rpm
601454f1c882149aaf10f4ec87278876  mod_jk-debuginfo-1.2.20-1.el4s1.2.i386.rpm
69eba1ce187bcb64adc400af5836e8c7  mod_jk-manual-1.2.20-1.el4s1.2.i386.rpm

x86_64:
f59150fc0501348d6031cea0b1df2eb1  mod_jk-ap20-1.2.20-1.el4s1.2.x86_64.rpm
4f6214772bb4a0412ccc892b3e052413  mod_jk-debuginfo-1.2.20-1.el4s1.2.x86_64.rpm
68a22cc1317cb05d979d29a2f5288ed3  mod_jk-manual-1.2.20-1.el4s1.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFF6G5GXlSAg2UNWIIRAnezAJ4jORvUKBGHkOiGA1rUFnvzUk/35wCfXrrT
Y9uSPs+rg1DgFvGHaubmaVs=
=RIjG
-----END PGP SIGNATURE-----



-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC