PT-2005-1837 · Apache · Apache Tomcat

Published 2005-03-20 · Updated 2017-07-11 · CVE-2005-0808

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 5.x Tomcat version 3.x

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, by sending a crafted AJP12 packet to TCP port 8007. This can be achieved by sending the right sequence of bytes to the AJP12 protocol port.

Recommendations For Tomcat version 3.x, ensure that the AJP12 protocol port (TCP 8007 by default) is adequately firewalled to prevent remote access. For versions prior to 5.x, update to version 5.x or later to resolve the issue. At the moment, there is no information about a newer version that contains a fix for Tomcat 3.x, as there are no plans to issue an update for this version.

Fix

Related Identifiers

CVE-2005-0808

Affected Products

Apache Tomcat

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-0808 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19681 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0808 · Note
• https://tomcat.apache.org/security-3 · Note
• http://hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html · Note
• http://kb.cert.org/vuls/id/204710 · Note
• http://kb.cert.org/vuls/id/JGEI-6A2LEF · Note
• http://securityfocus.com/bid/12795 · Note