PT-2004-1734 · Apache+1 · Apache+1

Published 2004-11-19 · Updated 2017-07-11 · CVE-2004-0646

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JRun versions 3.0 through 4.0

Description The issue is related to a buffer overflow in the WriteToLog function when verbose logging is enabled. This can be exploited by remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.

Recommendations For JRun versions 3.0 through 4.0, consider disabling verbose logging as a temporary workaround to minimize the risk of exploitation. Restrict access to the WriteToLog function until a patch is available. Avoid using the Content-Type field in HTTP headers with overly long values in the affected web server connectors, such as mod jrun and mod jrun20 for Apache, until the issue is resolved.

Fix

Related Identifiers

CVE-2004-0646

Affected Products

Apache

Jrun

References · 8

• http://macromedia.com/devnet/security/security_zone/mpsb04-08.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-0646 · Security Note
• http://securityfocus.com/bid/11245 · Vendor Advisory
• http://securityfocus.com/archive/1/377194 · Note
• http://secunia.com/advisories/12647 · Note
• http://kb.cert.org/vuls/id/990200 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17485 · Note
• http://macromedia.com/devnet/security/security_zone/mpsb04-09.html · Note