PT-2005-3986 · Apache · Apache Tomcat

Published 2005-10-06 · Updated 2022-05-01 · CVE-2005-3164

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.0.1 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.36

Description The issue arises when a connection is broken before request body data is sent in a POST request, potentially leading to an information leak. This occurs when "unsuitable request body data" is used for a different request. The problem is related to the handling of requests by the AJP connector when a client specifies a Content-Length but disconnects before sending any of the request body, causing the connector to process the request using the request body of the previous request.

Recommendations For Apache Tomcat versions 4.0.1 through 4.0.6, consider using the default, supported Coyote AJP connector as a workaround. For Apache Tomcat versions 4.1.0 through 4.1.36, consider using the default, supported Coyote AJP connector as a workaround. As a temporary workaround, consider disabling the AJP connector until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-3164

GHSA-QHQV-Q4XG-F6G7

Affected Products

Apache Tomcat

References · 25

• http://secunia.com/advisories/17019 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhqv-q4xg-f6g7 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1979/references · Vendor Advisory
• http://secunia.com/advisories/30899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3164 · Security Note
• http://secunia.com/advisories/30908 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1981/references · Vendor Advisory
• http://secunia.com/advisories/30802 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 · Vendor Advisory
• http://tomcat.apache.org/security-4.html · Vendor Advisory
• http://jvn.jp/jp/JVN%2379314822/index.html · Note
• http://support.apple.com/kb/HT2163 · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• http://hitachi-support.com/security_e/vuls_e/HS05-019_e/01-e.html · Note