REDHAT-BUG-1382352: Buffer Overflow
First published: Thu Oct 06 2016(Updated: )
The IIS/ISAPI specific code implements special handling when a virtual host is present. The virtual host name and the URI are concatenated to create a virtual host mapping rule. It was found that the length checks prior to writing to the target buffer for this rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow. Upstream patch: <a href="https://svn.apache.org/viewvc?view=revision&revision=1762057">https://svn.apache.org/viewvc?view=revision&revision=1762057</a> External References: <a href="https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.42">https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.42</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Tomcat Connectors | <1.2.42 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://svn.apache.org/viewvc?view=revision&revision=1762057
- https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.42
- https://rhn.redhat.com/errata/RHSA-2016-2957.html
- https://access.redhat.com/errata/RHSA-2017:0194
- https://access.redhat.com/errata/RHSA-2017:0193
- https://bugzilla.redhat.com/show_bug.cgi?id=1382352
Frequently Asked Questions
What is the severity of REDHAT-BUG-1382352?
The severity of REDHAT-BUG-1382352 is considered high due to potential buffer overflow risks.
How do I fix REDHAT-BUG-1382352?
To fix REDHAT-BUG-1382352, update the Apache Tomcat JK Connector to version 1.2.42 or later.
What are the potential impacts of REDHAT-BUG-1382352?
The impacts of REDHAT-BUG-1382352 may include remote code execution and denial of service if exploited.
Which software is affected by REDHAT-BUG-1382352?
REDHAT-BUG-1382352 affects the Apache Tomcat JK Connector versions prior to 1.2.42.
Is REDHAT-BUG-1382352 still a threat if I have upgraded my software?
If you have upgraded your Apache Tomcat JK Connector to version 1.2.42 or later, REDHAT-BUG-1382352 is no longer a threat.
- agent/references
- agent/type
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-6808
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/apache
- canonical/apache tomcat connectors