SecuriTeam - Apache Tomcat mod_jk Information Disclosure Vulnerability

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

Situations where faulty clients set Content-Length without providing data, or where a user submits repeated requests very quickly may permit one user to view the Apache Tomcat mod_jk response associated with a different user's request.

Credit:
The information has been provided by Mark Thomas.

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

Vulnerable Systems:
* mod_jk version 1.2.0 up to version 1.2.26

Immune Systems:
* mod_jk version 1.2.27 or newer

CVE Information:
CVE-2008-5519

	Apple Webkit Blink Event Dangling Pointer Remote Code Execution Vulnerability
	Microsoft Virtual PC Hypervisor Memory Protection Vulnerability
	Apple WebKit HTML Element Use After Free Vulnerability
	Apple WebKit CSS Run-in Attribute Rendering Vulnerability
	Publique! CMS and SQL Injection Vulnerabilities
	Files2Links F2L-3000 SQL Injection Vulnerability
	HP-UX Running Apache Data Injection and DoS Vulnerability
	MIT krb5 KDC denial of service in cross-realm referral processing
	AproxEngine Multiple Vulnerabilities
	APC Switched Rack PDU XSS Vulnerability
	HP-UX Running OpenSSL Unauthorized Data Injection and Denial of Service
	HP OpenView NNM snmpviewer.exe CGI Host Header Stack Overflow Vulnerability
	HP OpenView NNM ovwebsnmpsrv.exe OVwSelection Stack Overflow Vulnerability
	HP-UX Running VRTSweb Remote Execution of Arbitrary Code and Privilege Escalation
	FreeBSD SSL and TLS Session Renegotiation vulnerability

Featured Articles

	Microsoft Embedded OpenType Font Engine Heap Buffer Overflow (MS09-029)
	Virtualmin Multiple Vulnerabilities
	Microsoft WordPad Word97 Converter Stack Buffer Overflow Vulnerability (MS09-010)
	WordPress Unchecked Privileges in admin.php and Multiple Information Disclosures
	Microsoft PowerPoint Conversion Filter Heap Corruption Vulnerability (MS09-017)
	Adobe Shockwave Player Director File Parsing Pointer Overwrite
	Mozilla Firefox Java Applet Loading Vulnerability

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs