CVE-2007-0774 Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and...
HighCVSS 7.5
EPSS 81.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat jk web server connector | = 1.2.19 | No fix listed |
| apache tomcat jk web server connector | = 1.2.20 | No fix listed |
| debian/libapache-mod-jk(Debian:12) | < 1:1.2.21-1 | 1:1.2.21-1 |
| debian/libapache-mod-jk(Debian:13) | < 1:1.2.21-1 | 1:1.2.21-1 |
| debian/libapache-mod-jk(Debian:14) | < 1:1.2.21-1 | 1:1.2.21-1 |
References
- Debian Security Tracker CVE-2007-0774 vendor-advisory
- SSRT071447 vendor-advisory
- 24398 third-party-advisory
- 24558 third-party-advisory
- 27037 third-party-advisory
- 28711 third-party-advisory
- 1017719 vdb-entry
- tomcat.apache.org patch
- tomcat.apache.org
- 20080130 Cisco Wireless Control System Tomcat mod_jk.so Vulnerability vendor-advisory
- GLSA-200703-16 vendor-advisory
- RHSA-2007:0096 vendor-advisory
- 20070302 ZDI-07-008: Apache Tomcat JK Web Server Connector Long URL Stack Overflow Vulnerability mailing-list
- 22791 vdb-entry
- ADV-2007-0809 vdb-entry
- ADV-2007-3386 vdb-entry
- ADV-2008-0331 vdb-entry
- www.zerodayinitiative.com vendor-advisory
- tomcat-mapuritoworker-bo(32794) vdb-entry
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- oval:org.mitre.oval:def:5513 signature vdb-entry