ZeroBox Vulnerability Database

漏洞起因
设计错误
 
影响系统
Apache Software Foundation Tomcat 6.0.18
Apache Software Foundation Tomcat 6.0.16
Apache Software Foundation Tomcat 6.0.15
Apache Software Foundation Tomcat 6.0.14
Apache Software Foundation Tomcat 6.0.13
Apache Software Foundation Tomcat 6.0.12
Apache Software Foundation Tomcat 6.0.11
Apache Software Foundation Tomcat 6.0.10
Apache Software Foundation Tomcat 6.0.9
Apache Software Foundation Tomcat 6.0.8
Apache Software Foundation Tomcat 6.0.7
Apache Software Foundation Tomcat 6.0.6
Apache Software Foundation Tomcat 6.0.5
Apache Software Foundation Tomcat 6.0.4
Apache Software Foundation Tomcat 6.0.3
Apache Software Foundation Tomcat 6.0.2
Apache Software Foundation Tomcat 6.0.1
Apache Software Foundation Tomcat 6.0
Apache Software Foundation Tomcat 5.5.27
Apache Software Foundation Tomcat 5.5.26
Apache Software Foundation Tomcat 5.5.25
Apache Software Foundation Tomcat 5.5.24
Apache Software Foundation Tomcat 5.5.23
Apache Software Foundation Tomcat 5.5.22
Apache Software Foundation Tomcat 5.5.21
Apache Software Foundation Tomcat 5.5.20
Apache Software Foundation Tomcat 5.5.20
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.2
Apache Software Foundation Tomcat 5.5.19
Apache Software Foundation Tomcat 5.5.18
Apache Software Foundation Tomcat 5.5.17
Apache Software Foundation Tomcat 5.5.17
Apache Software Foundation Tomcat 5.5.16
Apache Software Foundation Tomcat 5.5.15
Apache Software Foundation Tomcat 5.5.14
Apache Software Foundation Tomcat 5.5.13
Apache Software Foundation Tomcat 5.5.12
Apache Software Foundation Tomcat 5.5.12
Apache Software Foundation Tomcat 5.5.11
Apache Software Foundation Tomcat 5.5.11
Apache Software Foundation Tomcat 5.5.10
Apache Software Foundation Tomcat 5.5.10
Apache Software Foundation Tomcat 5.5.9
Apache Software Foundation Tomcat 5.5.8
Apache Software Foundation Tomcat 5.5.8
Apache Software Foundation Tomcat 5.5.7
Apache Software Foundation Tomcat 5.5.7
Apache Software Foundation Tomcat 5.5.6
Apache Software Foundation Tomcat 5.5.6
Apache Software Foundation Tomcat 5.5.5
Apache Software Foundation Tomcat 5.5.5
Apache Software Foundation Tomcat 5.5.4
Apache Software Foundation Tomcat 5.5.4
Apache Software Foundation Tomcat 5.5.3
Apache Software Foundation Tomcat 5.5.3
Apache Software Foundation Tomcat 5.5.2
Apache Software Foundation Tomcat 5.5.2
Apache Software Foundation Tomcat 5.5.1
Apache Software Foundation Tomcat 5.5.1
Apache Software Foundation Tomcat 5.5
Apache Software Foundation Tomcat 5.5
Apache Software Foundation Tomcat 4.1.39
Apache Software Foundation Tomcat 4.1.38
Apache Software Foundation Tomcat 4.1.37
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Tomcat 4.1.35
Apache Software Foundation Tomcat 4.1.34
Apache Software Foundation Tomcat 4.1.34
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.2
Apache Software Foundation Tomcat 4.1.32
Apache Software Foundation Tomcat 4.1.31
Apache Software Foundation Tomcat 4.1.30
Apache Software Foundation Tomcat 4.1.29
Apache Software Foundation Tomcat 4.1.28
Apache Software Foundation Tomcat 4.1.24
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.2
Apache Software Foundation Tomcat 4.1.12
Apache Software Foundation Tomcat 4.1.10
Apache Software Foundation Tomcat 4.1.3 beta
Apache Software Foundation Tomcat 4.1.3
Apache Software Foundation Tomcat 4.1
Apache Software Foundation Tomcat 4.1
– BSDI BSD/OS 4.0
– Caldera OpenLinux 2.4
– Conectiva Linux 5.1
– Debian Linux 2.3
– Debian Linux 2.2
– Debian Linux 2.1
– Digital UNIX 4.0
– FreeBSD FreeBSD 5.0
– FreeBSD FreeBSD 4.5
– MandrakeSoft Linux Mandrake 7.1
– MandrakeSoft Linux Mandrake 7.0
– NetBSD NetBSD 1.4.2 x86
– NetBSD NetBSD 1.4.1 x86
– RedHat Linux 6.2 i386
– RedHat Linux 6.1 i386
– SGI IRIX 6.5
– SGI IRIX 6.4
– SGI IRIX 3.3
– Sun Solaris 8
– Sun Solaris 7.0
 
不受影响系统
 
危害
远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。
 
攻击所需条件
攻击者必须访问Apache Tomcat。
 
漏洞信息
Apache Tomcat是一款开放源码的JSP应用服务器程序。
Apache Tomcat Java AJP Connector不正确处理请求的头字段数据，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。
如果Tomcat通过Java AJP Connector接收到非法头字段数据，它不返回一个错误就关闭AJP连接。如果Connector作为mod_jk负载均衡工作的一部分，那么会导致进入错误状态，并阻止使用将近一分钟，因此提交特殊构建的请求可导致拒绝服务攻击。
 
测试方法
GET /servlets-examples/ HTTP/1.1
Host: localhost:x
 
厂商解决方案
升级程序：
Apache Software Foundation Tomcat 4.1
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.10
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.12
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.24
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.28
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.29
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.3 beta
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.3
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.30
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.31
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.32
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.34
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.34
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.35
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.37
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.38
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 4.1.39
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.1
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.1
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.10
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.10
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.11
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.11
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.12
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.12
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.13
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.14
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.15
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.16
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.17
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.17
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.18
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.19
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.2
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.2
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.20
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.20
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.21
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.22
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.23
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.24
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.25
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.26
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 5.5.27
Apache Software Foundation Revision 7813628
http://svn.apache.org/viewvc?rev=781362&view=rev
Apache Software Foundation Tomcat 6.0
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.1
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.10
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.11
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.12
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.13
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.14
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.15
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.16
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.18
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.2
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.3
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.4
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.5
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.6
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.7
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.8
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
Apache Software Foundation Tomcat 6.0.9
Apache Software Foundation revision 742915
http://svn.apache.org/viewvc?rev=742915&view=rev
 
漏洞提供者
Apache