Overview
A vulnerability exists in the legacy version of the mod_jk2 Apache module. If successfully exploited, the vulnerability may allow an attacker to run arbitrary code on affected system.
Description
The host header field allows HTTP 1.1 (RFC 2616) compliant servers to host multiple domains using a single IP address. Per the IOActive Security Advisory Multiple Buffer Overflows in legacy mod_jk2 apache module 2.0.3-DEV and earlier: |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code. |
Solution
Upgrade mod_jk2 2.0.4 addresses this issue. |
Vendor Information
CVSS Metrics
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
References
Acknowledgements
Thanks to IOActive for information that was used in this report.
This document was written by Ryan Giobbi.
Other Information
CVE IDs: | CVE-2007-6258 |
Severity Metric: | 4.80 |
Date Public: | 2008-02-13 |
Date First Published: | 2008-02-14 |
Date Last Updated: | 2008-04-29 15:51 UTC |
Document Revision: | 11 |