CVE-2007-6258

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2007-6258
Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://securityreason.com/securityalert/3661 Broken Link
http://www.ioactive.com/pdfs/mod_jk2.pdf Third Party Advisory
http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf Broken Link
http://www.kb.cert.org/vuls/id/771937 Patch Third Party Advisory US Government Resource
http://www.securityfocus.com/archive/1/487983/100/100/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/27752 Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2008/0572 URL Repurposed
https://www.exploit-db.com/exploits/5330 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/5386 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:mod_jk:2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.3_dev:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:f5:big-ip:9.2.3.30:*:*:*:*:*:*:*
History

03 Feb 2022, 19:43

Type Values Removed Values Added
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/5330 - (EXPLOIT-DB) https://www.exploit-db.com/exploits/5330 - Third Party Advisory, VDB Entry
References (VUPEN) http://www.vupen.com/english/advisories/2008/0572 - (VUPEN) http://www.vupen.com/english/advisories/2008/0572 - URL Repurposed
References (BUGTRAQ) http://www.securityfocus.com/archive/1/487983/100/100/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/487983/100/100/threaded - Third Party Advisory, VDB Entry
References (BID) http://www.securityfocus.com/bid/27752 - Patch (BID) http://www.securityfocus.com/bid/27752 - Patch, Third Party Advisory, VDB Entry
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/5386 - (EXPLOIT-DB) https://www.exploit-db.com/exploits/5386 - Third Party Advisory, VDB Entry
References (CERT-VN) http://www.kb.cert.org/vuls/id/771937 - Patch, US Government Resource (CERT-VN) http://www.kb.cert.org/vuls/id/771937 - Patch, Third Party Advisory, US Government Resource
References (MISC) http://www.ioactive.com/pdfs/mod_jk2.pdf - (MISC) http://www.ioactive.com/pdfs/mod_jk2.pdf - Third Party Advisory
References (MISC) http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf - (MISC) http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf - Broken Link
References (SREASON) http://securityreason.com/securityalert/3661 - (SREASON) http://securityreason.com/securityalert/3661 - Broken Link
CPE cpe:2.3:a:apache_software_foundation:mod_jk:2.0.3_dev:*:*:*:*:*:*:*
cpe:2.3:a:apache_software_foundation:mod_jk:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache_software_foundation:mod_jk:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache_software_foundation:mod_jk:2.0:*:*:*:*:*:*:*		 cpe:2.3:a:apache:mod_jk:2.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.3_dev:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:mod_jk:2.0.2:*:*:*:*:*:*:*
First Time Apache
Apache mod Jk
Information

Published : 2008-02-19 00:00

Updated : 2023-12-10 10:40

NVD link : CVE-2007-6258

Mitre link : CVE-2007-6258

CVE.ORG link : CVE-2007-6258

JSON object : View

Products Affected

apache

  • mod_jk

f5

  • big-ip
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer