RedHatRHSA-2007:0164(RHSA-2007:0164) Critical: mod_jk security update
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.621 Medium
EPSS
Percentile
97.8%
mod_jk is a Tomcat connector that can be used to communicate between Tomcat
and the Apache HTTP Server 2.
A stack overflow flaw was found in the URI handler of mod_jk. A remote
attacker could visit a carefully crafted URL being handled by mod_jk and
trigger this flaw, which could lead to the execution of arbitrary code as the
‘apache’ user. (CVE-2007-0774)
Users of mod_jk should upgrade to these updated packages, which contain a
backported patch to correct this issue.
Red Hat would like to thank TippingPoint and the Zero Day Initiative for
reporting this issue.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | any | ia64 | mod_jk-manual | < 1.2.20-1jpp_1rh | mod_jk-manual-1.2.20-1jpp_1rh.ia64.rpm |
| RedHat | any | ppc | mod_jk-manual | < 1.2.20-1jpp_1rh | mod_jk-manual-1.2.20-1jpp_1rh.ppc.rpm |
| RedHat | any | i386 | mod_jk-ap20 | < 1.2.20-1jpp_1rh | mod_jk-ap20-1.2.20-1jpp_1rh.i386.rpm |
| RedHat | any | ppc | mod_jk-ap20 | < 1.2.20-1jpp_1rh | mod_jk-ap20-1.2.20-1jpp_1rh.ppc.rpm |
| RedHat | any | x86_64 | mod_jk-manual | < 1.2.20-1jpp_1rh | mod_jk-manual-1.2.20-1jpp_1rh.x86_64.rpm |
| RedHat | any | i386 | mod_jk-manual | < 1.2.20-1jpp_1rh | mod_jk-manual-1.2.20-1jpp_1rh.i386.rpm |
| RedHat | any | ia64 | mod_jk-ap20 | < 1.2.20-1jpp_1rh | mod_jk-ap20-1.2.20-1jpp_1rh.ia64.rpm |
| RedHat | any | x86_64 | mod_jk-ap20 | < 1.2.20-1jpp_1rh | mod_jk-ap20-1.2.20-1jpp_1rh.x86_64.rpm |
Related
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.621 Medium
EPSS
Percentile
97.8%