Reported May 29, 2002, by David Litchfield.

VERSIONS AFFECTED

 

·         Macromedia JRun Server 3.1 and 3.0 builds prior to 26414

 

DESCRIPTION
A buffer overrun condition exists in Macromedia’s JRun Server 3.1 and 3.0. The Internet Server AP (ISAPI) .dll filter that JRun uses to handle requests for .jsp resources doesn't properly handle overly long host header fields. As a result, an attacker can gain control over the process’ execution. Visit the discoverer’s Web site for a more detailed advisory.

 


VENDOR RESPONSE

Macromedia has released a bulletin regarding this vulnerability and recommends that affected users apply the appropriate patch listed in the bulletin.

 

CREDIT
Discovered by David Litchfield of Next Generation Security Software.