CVE-2016-6808: Buffer Overflow
Buffer overflow in Apache Tomcat Connectors (modjk) before 1.2.42.
Other sources
The IIS/ISAPI specific code implements special handling when a virtual host is present. The virtual host name and the URI are concatenated to create a virtual host mapping rule. It was found that the length checks prior to writing to the target buffer for this rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow.
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1762057
External References:
https://tomcat.apache.org/security-jk.html#FixedinApacheTomcatJKConnector1.2.42
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6808?
CVE-2016-6808 is classified as a high-severity vulnerability due to the potential for a remote code execution through a buffer overflow.
How do I fix CVE-2016-6808?
To fix CVE-2016-6808, upgrade the Apache Tomcat Connectors (mod_jk) to version 1.2.42 or later.
Which versions are affected by CVE-2016-6808?
CVE-2016-6808 affects Apache Tomcat Connectors (mod_jk) versions prior to 1.2.42.
What types of systems are vulnerable to CVE-2016-6808?
CVE-2016-6808 predominantly affects systems using the Apache Tomcat Connectors (mod_jk) with IIS/ISAPI integration.
Is CVE-2016-6808 easy to exploit?
CVE-2016-6808 can be exploited by attackers to execute malicious code remotely, making it a critical security risk.