PT-2009-1293 · Apache · Connector/J

Published 2009-04-09 · Updated 2024-06-15 · CVE-2008-5519

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JK Connector (aka mod jk) versions 1.2.0 through 1.2.26

Description The issue allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client under certain circumstances, including when a request from a different client includes a Content-Length header but no POST data, or when there is a rapid series of requests. This is related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Recommendations For JK Connector (aka mod jk) versions 1.2.0 through 1.2.26, consider updating to a version outside of this range to resolve the issue. As a temporary workaround, restrict access to the AJP protocol to minimize the risk of exploitation. Avoid using the Content-Length header in requests to the affected connector until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-5519

DSA-1810-1

OPENSUSE-SU-2024:10488-1

RHSA-2009:0446

RHSA-2009:1087

RHSA-2009:1618

Affected Products

Connector/J

References · 34

• 🔥 http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/xdocs/miscellaneous/changelog.xml?view=markup&pathrev=702540 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5519 · Vendor Advisory
• http://debian.org/security/2009/dsa-1810 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10488-1 · Vendor Advisory
• http://svn.eu.apache.org/viewvc?view=rev&revision=702540 · Vendor Advisory
• http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/native/common/jk_ajp_common.c?r1=702387&r2=702540&pathrev=702540&diff_format=h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5519 · Security Note
• http://redhat.com/support/errata/RHSA-2009-0446.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-262468-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/34621 · Vendor Advisory
• http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-5519 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=490201 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5519 · Vendor Advisory