Vulnerability Note VU#771937

Apache mod_jk2 host header buffer overflow

Per the IOActive Security Advisory Multiple Buffer Overflows in legacy mod_jk2 apache module 2.0.3-DEV and earlier:

mod_jk2 versions less than 2.0.4 are vulnerable to multiple stack overflow vulnerabilities. Specifically, IOActive has discovered multiple
locations where these vulnerabilities are exploitable via the Host request header in any given request. These overflows all result in remote
code execution under the user of the running apache process. Although a legacy module which is end of life, certain vendors may use this
module in their products rendering them vulnerable to remote exploitation.

mod_jk2 2.0.4 addresses this issue.

Systems Affected

http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf
http://today.java.net/pub/n/mod_jk22.0.4
http://www.w3.org/Protocols/rfc2616/rfc2616.html
http://www.jmarshall.com/easy/http/#http1.1c1

Credit

Thanks to IOActive for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.