7.5
HIGH

CVE-2016-6808

Published: 12/04/2017 Updated: 20/04/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

Vulnerability Summary

Apache Tomcat JK Connector Buffer Overflow Vulnerability

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.

A vulnerability in Apache Tomcat JK Connector could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to insufficient bounds checking by the affected software. An attacker could exploit this vulnerability by sending a crafted URI to a targeted virtual host. An exploit could trigger a buffer overflow condition that the attacker could leverage to execute arbitrary code or cause a DoS condition. Apache has confirmed the vulnerability and released software updates.

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Complexity: LOW
Authentication: NONE
Access Vector: NETWORK
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Affected Products

Vendor Product Versions
ApacheTomcat Jk Web Server Connector1.2.41

Vendor Advisories

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2423 Release on RHEL 6 Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2423 and fix several bugs, and add various enhancements are now available for Red Hat En ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2423 Release on RHEL 7 Type/Severity Security Advisory: Important Topic An update is now available for JBoss Core Services on RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerab ...
It was found that the length checks prior to writing to the target buffer for creating a virtual host mapping rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...

References