PT-2004-1734 · Apache+1 · Apache+1

Publicado 2004-11-19 · Atualizado 2017-07-11 · CVE-2004-0646

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JRun versions 3.0 through 4.0

Description The issue is related to a buffer overflow in the WriteToLog function when verbose logging is enabled. This can be exploited by remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.

Recommendations For JRun versions 3.0 through 4.0, consider disabling verbose logging as a temporary workaround to minimize the risk of exploitation. Restrict access to the WriteToLog function until a patch is available. Avoid using the Content-Type field in HTTP headers with overly long values in the affected web server connectors, such as mod jrun and mod jrun20 for Apache, until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-0646

Produtos afetados

Apache

Jrun

Referências · 8

• http://securityfocus.com/archive/1/377194 · Nota
• http://macromedia.com/devnet/security/security_zone/mpsb04-08.html · Correção
• http://secunia.com/advisories/12647 · Nota
• http://kb.cert.org/vuls/id/990200 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0646 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17485 · Nota
• http://securityfocus.com/bid/11245 · Aviso do Fabricante
• http://macromedia.com/devnet/security/security_zone/mpsb04-09.html · Nota