PT-2003-1330 · Apache · Jakarta Tomcat+1

Published 2003-02-07 · Updated 2022-04-29 · CVE-2003-0045

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat versions prior to 3.3.1a

Description The issue allows remote attackers to cause a denial of service, resulting in thread hang and resource consumption. This occurs when a request is made for a JSP page containing an MS-DOS device name, such as aux.jsp. A sequence of such requests may cause all request processing threads to become unresponsive, leading to Tomcat becoming unresponsive.

Recommendations For Jakarta Tomcat versions prior to 3.3.1a, update to version 3.3.1a or later to resolve the issue. As a temporary workaround, consider restricting access to JSP pages that match Windows DOS device names to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2003-0045

GHSA-W97X-XFXF-F9XJ

Affected Products

Apache Tomcat

Jakarta Tomcat

References · 6

• https://osv.dev/vulnerability/GHSA-w97x-xfxf-f9xj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0045 · Security Note
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0045 · Note
• https://tomcat.apache.org/security-3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12102 · Note