Apache Tomcat JK Connector: Information disclosure

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200906-04 / mod_jk
Release Date	June 29, 2009
Latest Revision	June 29, 2009: 01
Impact	low
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
www-apache/mod_jk	< 1.2.27	>= 1.2.27	All supported architectures

Related bugreports: #265455

Synopsis

An error in the Apache Tomcat JK Connector might allow for an information disclosure flaw.

2. Impact Information

Background

The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.

Description

The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the "Content-Length" header while not providing data and (2) clients sending repeated requests very quickly.

Impact

A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Apache Tomcat JK Connector users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27"

4. References

CVE-2008-5519

Updated June 29, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.