Apache mod_jk2 host header buffer overflow

2008-02-14T00:00:00
ID VU:771937
Type cert
Reporter CERT
Modified 2008-04-29T00:00:00

Description

Overview

A vulnerability exists in the legacy version of the mod_jk2 Apache module. If successfully exploited, the vulnerability may allow an attacker to run arbitrary code on affected system.

Description

The host header field allows HTTP 1.1 (RFC 2616) compliant servers to host multiple domains using a single IP address.

Per the IOActive Security Advisory Multiple Buffer Overflows in legacy mod_jk2 apache module 2.0.3-DEV and earlier:
mod_jk2 versions less than 2.0.4 are vulnerable to multiple stack overflow vulnerabilities. Specifically, IOActive has discovered multiple
locations where these vulnerabilities are exploitable via the Host request header in any given request. These overflows all result in remote
code execution under the user of the running apache process. Although a legacy module which is end of life, certain vendors may use this
module in their products rendering them vulnerable to remote exploitation.


Impact

A remote, unauthenticated attacker may be able to execute arbitrary code.


Solution

Upgrade

mod_jk2 2.0.4 addresses this issue.


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
Apache HTTP Server Project| | 10 Jan 2008| 14 Feb 2008
F5 Networks, Inc.| | 15 Feb 2008| 18 Feb 2008
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf>
  • <http://today.java.net/pub/n/mod_jk22.0.4>
  • <http://www.w3.org/Protocols/rfc2616/rfc2616.html>
  • <http://www.jmarshall.com/easy/http/#http1.1c1>

Credit

Thanks to IOActive for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2007-6258
  • Date Public: 13 Feb 2008
  • Date First Published: 14 Feb 2008
  • Date Last Updated: 29 Apr 2008
  • Severity Metric: 4.80
  • Document Revision: 11