CVE-2004-0646

2004-12-2305:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-0646

buffer overflow

jrun

web server

cve

7.8 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.082 Low

EPSS

Percentile

94.3%

JSON

Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.

CPENameOperatorVersion
macromedia:jrunmacromedia jruneq3.1
macromedia:jrunmacromedia jruneq3.0
macromedia:coldfusionmacromedia coldfusioneq6.1
macromedia:coldfusionmacromedia coldfusioneq6.0
macromedia:jrunmacromedia jruneq4.0

CPE	Name	Operator	Version
macromedia:jrun	macromedia jrun	eq	3.1
macromedia:jrun	macromedia jrun	eq	3.0
macromedia:coldfusion	macromedia coldfusion	eq	6.1
macromedia:coldfusion	macromedia coldfusion	eq	6.0
macromedia:jrun	macromedia jrun	eq	4.0