----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
Apache Tomcat AJP12 Protocol Denial of Service Vulnerability

SECUNIA ADVISORY ID:
SA14569

VERIFY ADVISORY:
http://secunia.com/advisories/14569/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
>From local network

SOFTWARE:
Apache Tomcat 3.x
http://secunia.com/product/426/

DESCRIPTION:
Hitachi Incident Response Team has reported a vulnerability in
Tomcat, which can be exploited by malicious people to cause a DoS
(Denial of Service).

The vulnerability is caused due to an error in the servlet / JSP
communication handling for the AJP12 protocol. This can be exploited
to cause a vulnerable server to stop processing further requests by
sending a specially crafted request to the APJ12 protocol port
(8007/tcp by default).

The vulnerability has been reported in version 3.x.

SOLUTION:
The vulnerability has been fixed in the 5.x releases.

Filter traffic to the APJ12 protocol port (default is 8007/tcp).

PROVIDED AND/OR DISCOVERED BY:
Hitachi Incident Response Team

OTHER REFERENCES:
US-CERT VU#204710:
http://www.kb.cert.org/vuls/id/204710

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------