[SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector

2009-06-05T00:00:00
ID SECURITYVULNS:DOC:21954
Type securityvulns
Reporter Securityvulns
Modified 2009-06-05T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

CVE-2009-0033: Apache Tomcat denial of service vulnerability

Severity: important

Vendor: The Apache Software Foundation

Versions Affected: Tomcat 6.0.0 to 6.0.18 Tomcat 5.5.0 to 5.5.27 Tomcat 4.1.0 to 4.1.39

The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.

Description: If Tomcat receives a request with invalid headers via the Java AJP connector, it does not return an error and instead closes the AJP connection. In case this connector is member of a mod_jk load balancing worker, this member will be put into an error state and will be blocked from use for approximately one minute. Thus the behaviour can be used for a denial of service attack using a carefully crafted request.

Mitigation: 6.0.x users should do one of the following: - upgrade to 6.0.20 - apply this patch http://svn.apache.org/viewvc?rev=742915&view=rev 5.5.x users should do one of the following: - upgrade to 5.5.28 when released - apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev 4.1.x users should do one of the following: - upgrade to 4.1.40 when released - apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev

Example: GET /servlets-examples/ HTTP/1.1 Host: localhost:x

Credit: This issue was discovered by Yoshihito Fukuyama.

References: http://tomcat.apache.org/security.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-4.html

The Apache Tomcat Security Team

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkommc4ACgkQb7IeiTPGAkNJNACePbuHUz9m9P/lR/+hfhXh4TpL V+EAnRjaiXwAkLJROzGDQebAqyNchEJt =OHhB -----END PGP SIGNATURE-----