Executive Summary

Summary
Title Cisco Wireless Control System Tomcat mod_jk.so Vulnerability
Informations
Name cisco-sa-20080130-wcs First vendor Publication 2007-12-10
Vendor Cisco Last vendor Modification 2008-01-30
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Apache Tomcat is the servlet container for JavaServlet and JavaServer Pages Web within the Cisco Wireless Control System (WCS). A vulnerability exists in the mod_jk.so URI handler within Apache Tomcat which, if exploited, may result in a remote code execution attack.

Original Source

Url : http://www.cisco.com/en/US/products/products_security_advisory09186a008093 (...)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5513
 
Oval ID: oval:org.mitre.oval:def:5513
Title: HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS)
Description: Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
Family: unix Class: vulnerability
Reference(s): CVE-2007-0774
 Version: 9
Platform(s): HP-UX 11
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

SAINT Exploits

Description Link
Apache Tomcat JK Web Server Connector URI worker map buffer overflow More info here

OpenVAS Exploits

Date Description
2009-05-05 Name : HP-UX Update for Apache HPSBUX02262
File : nvt/gb_hp_ux_HPSBUX02262.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200703-16 (mod_jk)
File : nvt/glsa_200703_16.nasl
2008-09-04 Name : FreeBSD Ports: mod_jk-ap2, mod_jk
File : nvt/freebsd_mod_jk-ap2.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
33855 Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Ov...

A buffer overflow exists in Tomcat. The JK Web Server Connector fails to validate long URL requests resulting in a stack overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2014-01-10 Apache Tomcat JK Web Server Connector long URL stack overflow attempt
RuleID : 18287 - Revision : 3 - Type : SPECIFIC-THREATS
2014-01-10 Generic HyperLink buffer overflow attempt
RuleID : 17410 - Revision : 27 - Type : OS-WINDOWS
2014-01-10 Apache Tomcat JK Web Server Connector long URL stack overflow attempt - 2
RuleID : 17108 - Revision : 4 - Type : SPECIFIC-THREATS
2014-01-10 Apache Tomcat JK Web Server Connector long URL stack overflow attempt - 1
RuleID : 17107 - Revision : 7 - Type : SERVER-APACHE
2019-01-15 (http_inspect)oversizerequest-uridirectory
RuleID : 15 - Revision : 2 - Type :

Nessus® Vulnerability Scanner

Date Description
2007-03-18 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200703-16.nasl - Type : ACT_GATHER_INFO
2007-03-15 Name : The remote web server includes a module that is affected by an overflow vulne...
File : mod_jk_long_url_overflow.nasl - Type : ACT_ATTACK
2007-03-06 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_cf86c644cb6c11db8e9d000c6ec775d9.nasl - Type : ACT_GATHER_INFO