GLSA 200906-04: Apache Tomcat JK Connector: Information disclosure

http://security.gentoo.org/

Severity:	low
Title:	Apache Tomcat JK Connector: Information disclosure
Date:	06/29/2009
Bugs:	#265455
ID:	200906-04

Synopsis

An error in the Apache Tomcat JK Connector might allow for an information disclosure flaw.

Background

The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
www-apache/mod_jk	< 1.2.27	>= 1.2.27	All supported architectures

Description

The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the "Content-Length" header while not providing data and (2) clients sending repeated requests very quickly.

Impact

A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.

Workaround

There is no known workaround at this time.

Resolution

All Apache Tomcat JK Connector users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27"

References

CVE-2008-5519

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200906-04.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.