[SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2009-0033: Apache Tomcat denial of service vulnerability
Severity: important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.
Description:
If Tomcat receives a request with invalid headers via the Java AJP
connector, it does not return an error and instead closes the AJP
connection. In case this connector is member of a mod_jk load balancing
worker, this member will be put into an error state and will be blocked
from use for approximately one minute. Thus the behaviour can be used
for a denial of service attack using a carefully crafted request.
Mitigation:
6.0.x users should do one of the following:
- upgrade to 6.0.20
- apply this patch http://svn.apache.org/viewvc?rev=742915&view=rev
5.5.x users should do one of the following:
- upgrade to 5.5.28 when released
- apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev
4.1.x users should do one of the following:
- upgrade to 4.1.40 when released
- apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev
Example:
GET /servlets-examples/ HTTP/1.1
Host: localhost:x
Credit:
This issue was discovered by Yoshihito Fukuyama.
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-4.html
The Apache Tomcat Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkommc4ACgkQb7IeiTPGAkNJNACePbuHUz9m9P/lR/+hfhXh4TpL
V+EAnRjaiXwAkLJROzGDQebAqyNchEJt
=OHhB
-----END PGP SIGNATURE-----