[NEWS] Apache Tomcat JK Web Server Connector Long URL Stack Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Apache Tomcat JK Web Server Connector Long URL Stack Overflow
------------------------------------------------------------------------


SUMMARY

Apache <http://tomcat.apache.org/> Tomcat is the servlet container that
is used in the official Reference Implementation for the Java Servlet and
JavaServer Pages technologies.

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apache Tomcat JK Web Server Connector.
Authentication is not required to exploit this vulnerability.

DETAILS

Affected Products:
* Tomcat JK Web Server Connector 1.2.19
* Tomcat JK Web Server Connector 1.2.20
* Tomcat 4.1.34
* Tomcat 5.5.20

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apache Tomcat JK Web Server Connector.
Authentication is not required to exploit this vulnerability.

The specific flaw exists in the URI handler for the mod_jk.so library,
map_uri_to_worker(), defined in native/common/jk_uri_worker_map.c. When
parsing a long URL request, the URI worker map routine performs an unsafe
memory copy. This results in a stack overflow condition which can be
leveraged to execute arbitrary code.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774>
CVE-2007-0774

Disclosure Timeline:
* 2007.02.16 - Vulnerability reported to vendor
* 2007.02.26 - Digital Vaccine released to TippingPoint customers
* 2007.03.02 - Coordinated public release of advisory


ADDITIONAL INFORMATION

The information has been provided by Zero Day Initiative (ZDI).
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-07-008.html>
http://www.zerodayinitiative.com/advisories/ZDI-07-008.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages