PT-2009-2745 · Apache+2 · Apache Tomcat+2

Published 2009-06-03 · Updated 2023-02-13 · CVE-2009-0033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18

Description The issue allows remote attackers to cause a denial of service, resulting in an application outage, by sending a crafted request with invalid headers via the Java AJP connector when mod jk load balancing is used. This can lead to temporary blocking of connectors that have encountered errors. For instance, an error can occur due to a malformed HTTP Host header. If the connector is part of a mod jk load balancing worker, it will be put into an error state and blocked from use for about one minute, which can be exploited for a denial of service attack using a carefully crafted request.

Recommendations For Apache Tomcat versions 4.1.0 through 4.1.39, consider disabling the Java AJP connector until a patch is available to prevent exploitation. For Apache Tomcat versions 5.5.0 through 5.5.27, restrict access to the mod jk load balancing worker to minimize the risk of denial of service attacks. For Apache Tomcat versions 6.0.0 through 6.0.18, avoid using the Java AJP connector with mod jk load balancing until the issue is resolved.

Exploit

Fix

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2009-0033

DSA-2207-1

GHSA-5CW4-GGX9-36VG

HPSBUX02579

HPSBUX02860

RHSA-2009:1164

RHSA-2009:1454

RHSA-2009:1506

RHSA-2009:1562

RHSA-2009:1563

RHSA-2009:1616

RHSA-2009:1617

RHSA-2009_1164

RHSA-2010:0602

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 100

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• http://securityfocus.com/bid/35193 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:136 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01246.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01216.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2526 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693 · Security Note