PT-2008-4686 · Apache · Apache Tomcat

Slavik Markovich · Published 2008-10-13 · Updated 2023-02-13 · CVE-2008-3271

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.0 through 4.1.31 Apache Tomcat version 5.5.0

Description: The issue allows remote attackers to bypass IP address restrictions and obtain sensitive information due to a synchronization problem and lack of thread safety. This is related to the RemoteFilterValve, RemoteAddrValve, and RemoteHostValve components. In rare circumstances, a user from a non-permitted IP address can gain access to a protected context.

Recommendations: For Apache Tomcat versions 4.1.0 through 4.1.31, consider disabling the RemoteFilterValve to minimize the risk of exploitation until a patch is available. For Apache Tomcat version 5.5.0, restrict access to the RemoteAddrValve and RemoteHostValve implementations to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider implementing additional thread safety measures to prevent instance-variable overwrites associated with concurrent request processing.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3271

RHSA-2008:1007

Affected Products

Apache Tomcat

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2008-3271 · Security Note
• http://tomcat.apache.org/security-4.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html · Vendor Advisory
• http://secunia.com/advisories/32213 · Vendor Advisory
• http://secunia.com/advisories/32398 · Vendor Advisory
• http://secunia.com/advisories/32234 · Vendor Advisory
• http://securitytracker.com/id?1021039 · Note
• https://tomcat.apache.org/security-4 · Note
• http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html · Note
• http://jvn.jp/en/jp/JVN30732239/index.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45791 · Note
• http://secunia.com/advisories/35684 · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Note
• http://securityfocus.com/archive/1/497220/100/0/threaded · Note
• http://nec.co.jp/security-info/secinfo/nv09-006.html · Note