CVE-2016-6808

high-risk

Published 2017-04-12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.

Do I need to act?

29.5% chance of exploitation in next 30 days

EPSS score — higher than 71% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Tomcat Jk Connector

Apache

Exploit http://packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Connector-1.2...

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2957.html

Mailing List http://seclists.org/fulldisclosure/2016/Oct/44

Vendor Advisory http://tomcat.apache.org/security-jk.html

Mailing List http://www.openwall.com/lists/oss-security/2016/10/06/4

Third Party Advisory http://www.securityfocus.com/bid/93429

Third Party Advisory http://www.securitytracker.com/id/1036969

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0193

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0194

Exploit http://packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Connector-1.2...

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2957.html

Mailing List http://seclists.org/fulldisclosure/2016/Oct/44

Vendor Advisory http://tomcat.apache.org/security-jk.html

Mailing List http://www.openwall.com/lists/oss-security/2016/10/06/4

and 10 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 15/34 · Moderate

Exposure 5/34 · Minimal