// For flags

CVE-2007-0774

Apache Tomcat JK Web Server Connector Long URL Stack Overflow Vulnerability

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.

Desbordamiento de búfer basado en pila en la función map_uri_to_worker (native/common/jk_uri_worker_map.c) en mod_jk.so para Apache Tomcat JK Web Server Connector 1.2.19 y 1.2.20, tal y como se usa en Tomcat 4.1.34 y 5.5.20, permite a atacantes remotos ejecutar código de su elección a través de una URL que dispara el desbordamiento de búfer en una rutina del mapa del trabajador URI.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Tomcat JK Web Server Connector. Authentication is not required to exploit this vulnerability.
The specific flaw exists in the URI handler for the mod_jk.so library, map_uri_to_worker(), defined in native/common/jk_uri_worker_map.c. When parsing a long URL request, the URI worker map routine performs an unsafe memory copy. This results in a stack overflow condition which can be leveraged to execute arbitrary code.

*Credits: Anonymous
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-02-06 CVE Reserved
  • 2007-03-02 CVE Published
  • 2007-07-08 First Exploit
  • 2024-08-07 CVE Updated
  • 2024-09-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
References (29)
URL Tag Source
http://secunia.com/advisories/24398 Third Party Advisory
http://secunia.com/advisories/24558 Third Party Advisory
http://secunia.com/advisories/27037 Third Party Advisory
http://secunia.com/advisories/28711 Third Party Advisory
http://securitytracker.com/id?1017719 Vdb Entry
http://tomcat.apache.org/security-jk.html X_refsource_confirm
http://www.securityfocus.com/archive/1/461734/100/0/threaded Mailing List
http://www.securityfocus.com/bid/22791 Vdb Entry
http://www.vupen.com/english/advisories/2007/0809 Vdb Entry
http://www.vupen.com/english/advisories/2007/3386 Vdb Entry
http://www.vupen.com/english/advisories/2008/0331 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32794 Vdb Entry
https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5513 Signature
URL Date SRC
https://www.exploit-db.com/exploits/4162 2007-07-08
https://www.exploit-db.com/exploits/16798 2010-07-25
URL Date SRC
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html 2023-02-13
URL Date SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 2023-02-13
http://www.cisco.com/en/US/products/products_security_advisory09186a008093f040.shtml 2023-02-13
http://www.gentoo.org/security/en/glsa/glsa-200703-16.xml 2023-02-13
http://www.redhat.com/support/errata/RHSA-2007-0096.html 2023-02-13
http://www.zerodayinitiative.com/advisories/ZDI-07-008.html 2023-02-13
https://access.redhat.com/security/cve/CVE-2007-0774 2007-04-12
https://bugzilla.redhat.com/show_bug.cgi?id=1618272 2007-04-12
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Tomcat Jk Web Server Connector
Search vendor "Apache" for product "Tomcat Jk Web Server Connector"
 1.2.19
Search vendor "Apache" for product "Tomcat Jk Web Server Connector" and version "1.2.19"
-
Affected
Apache
Search vendor "Apache"
 Tomcat Jk Web Server Connector
Search vendor "Apache" for product "Tomcat Jk Web Server Connector"
 1.2.20
Search vendor "Apache" for product "Tomcat Jk Web Server Connector" and version "1.2.20"
-
Affected