National Cyber Awareness System

Vulnerability Summary for CVE-2009-0033

Overview

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2009-1496

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2009/1496

External Source: BID

Name: 35193

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/35193

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-4.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-4.html

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=781362&view=rev

Type: Advisory; Patch Information

Hyperlink:http://svn.apache.org/viewvc?rev=781362&view=rev

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=742915&view=rev

Type: Advisory; Patch Information

Hyperlink:http://svn.apache.org/viewvc?rev=742915&view=rev

External Source: FEDORA

Name: FEDORA-2009-11356

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html

External Source: FEDORA

Name: FEDORA-2009-11352

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html

External Source: FEDORA

Name: FEDORA-2009-11374

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html

External Source: XF

Name: tomcat-ajp-dos(50928)

Hyperlink:http://xforce.iss.net/xforce/xfdb/50928

External Source: VUPEN

Name: ADV-2010-3056

Hyperlink:http://www.vupen.com/english/advisories/2010/3056

External Source: VUPEN

Name: ADV-2009-3316

Hyperlink:http://www.vupen.com/english/advisories/2009/3316

External Source: VUPEN

Name: ADV-2009-1856

Hyperlink:http://www.vupen.com/english/advisories/2009/1856

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2009-0016.html

External Source: BUGTRAQ

Name: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded

External Source: BUGTRAQ

Name: 20090603 [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/504044/100/0/threaded

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: MANDRIVA

Name: MDVSA-2009:138

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:138

External Source: MANDRIVA

Name: MDVSA-2009:136

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

External Source: DEBIAN

Name: DSA-2207

Hyperlink:http://www.debian.org/security/2011/dsa-2207

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4077

Hyperlink:http://support.apple.com/kb/HT4077

External Source: SUNALERT

Name: 263529

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1

External Source: SECTRACK

Name: 1022331

Hyperlink:http://securitytracker.com/id?1022331

External Source: SECUNIA

Name: 42368

Hyperlink:http://secunia.com/advisories/42368

External Source: SECUNIA

Name: 37460

Hyperlink:http://secunia.com/advisories/37460

External Source: SECUNIA

Name: 35788

Hyperlink:http://secunia.com/advisories/35788

External Source: SECUNIA

Name: 35685

Hyperlink:http://secunia.com/advisories/35685

External Source: SECUNIA

Name: 35344

Type: Advisory

Hyperlink:http://secunia.com/advisories/35344

External Source: SECUNIA

Name: 35326

Type: Advisory

Hyperlink:http://secunia.com/advisories/35326

External Source: OVAL

Name: oval:org.mitre.oval:def:5739

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5739

External Source: OVAL

Name: oval:org.mitre.oval:def:10231

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10231

External Source: HP

Name: SSRT101146

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: HPSBUX02860

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: SSRT100203

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: HP

Name: SSRT100203

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: SUSE

Name: SUSE-SR:2009:012

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

External Source: APPLE

Name: APPLE-SA-2010-03-29-1

Hyperlink:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

External Source: JVN

Name: JVN#87272440

Hyperlink:http://jvn.jp/en/jp/JVN87272440/index.html

References to Check Content

Identifier:oval:org.mitre.oval:def:5739

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:5739

Identifier:oval:org.mitre.oval:def:10231

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10231