A vulnerability exists in the legacy version of the mod_jk2 Apache module. If successfully exploited, the vulnerability may allow an attacker to run arbitrary code on affected system.
The host header field allows HTTP 1.1 (RFC 2616) compliant servers to host multiple domains using a single IP address.
Per the IOActive Security Advisory Multiple Buffer Overflows in legacy mod_jk2 apache module 2.0.3-DEV and earlier:
A remote, unauthenticated attacker may be able to execute arbitrary code.
mod_jk2 2.0.4 addresses this issue.
Thanks to IOActive for information that was used in this report.
This document was written by Ryan Giobbi.
|Date First Published:||2008-02-14|
|Date Last Updated:||2008-04-29 15:51 UTC|