5
CVSSv2

CVE-2009-0033

Published: 05/06/2009 Updated: 25/03/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Apache Tomcat 4.1.0 up to and including 4.1.39, 5.5.0 up to and including 5.5.27, and 6.0.0 up to and including 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote malicious users to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat 4.1.0

apache tomcat 4.1.1

apache tomcat 4.1.16

apache tomcat 4.1.17

apache tomcat 4.1.18

apache tomcat 4.1.24

apache tomcat 4.1.25

apache tomcat 4.1.30

apache tomcat 4.1.31

apache tomcat 4.1.5

apache tomcat 4.1.6

apache tomcat 5.5.10

apache tomcat 5.5.11

apache tomcat 5.5.18

apache tomcat 5.5.19

apache tomcat 5.5.26

apache tomcat 5.5.27

apache tomcat 5.5.9

apache tomcat 4.1.38

apache tomcat 6.0.4

apache tomcat 6.0.3

apache tomcat 6.0.8

apache tomcat 6.0.9

apache tomcat 4.1.10

apache tomcat 4.1.11

apache tomcat 4.1.19

apache tomcat 4.1.2

apache tomcat 4.1.26

apache tomcat 4.1.27

apache tomcat 4.1.32

apache tomcat 4.1.33

apache tomcat 4.1.7

apache tomcat 4.1.8

apache tomcat 5.5.12

apache tomcat 5.5.13

apache tomcat 5.5.2

apache tomcat 5.5.20

apache tomcat 5.5.3

apache tomcat 5.5.4

apache tomcat 4.1.39

apache tomcat 6.0.1

apache tomcat 6.0.2

apache tomcat 6.0.13

apache tomcat 6.0.16

apache tomcat 4.1.14

apache tomcat 4.1.15

apache tomcat 4.1.22

apache tomcat 4.1.23

apache tomcat 4.1.3

apache tomcat 4.1.36

apache tomcat 4.1.37

apache tomcat 4.1.4

apache tomcat 5.5.0

apache tomcat 5.5.1

apache tomcat 5.5.16

apache tomcat 5.5.17

apache tomcat 5.5.23

apache tomcat 5.5.24

apache tomcat 5.5.25

apache tomcat 5.5.7

apache tomcat 5.5.8

apache tomcat 6.0.14

apache tomcat 6.0.5

apache tomcat 6.0.6

apache tomcat 6.0.7

apache tomcat 4.1.12

apache tomcat 4.1.13

apache tomcat 4.1.20

apache tomcat 4.1.21

apache tomcat 4.1.28

apache tomcat 4.1.29

apache tomcat 4.1.34

apache tomcat 4.1.35

apache tomcat 4.1.9

apache tomcat 5.5.14

apache tomcat 5.5.15

apache tomcat 5.5.21

apache tomcat 5.5.22

apache tomcat 5.5.5

apache tomcat 5.5.6

apache tomcat 6.0.0

apache tomcat 6.0.15

apache tomcat 6.0.12

apache tomcat 6.0.11

apache tomcat 6.0.10

Vendor Advisories

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team D ...
Iida Minehiko discovered that Tomcat did not properly normalise paths A remote attacker could send specially crafted requests to the server and bypass security restrictions, gaining access to sensitive content (CVE-2008-5515) ...
Debian Bug report logs - #532362 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 6 Multiple Vulnerabilities Package: tomcat6; Maintainer for tomcat6 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun ...
Debian Bug report logs - #532363 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 5 Multiple Vulnerabilities Package: tomcat5; Maintainer for tomcat5 is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun 2009 20:39:02 UTC Severity: serious Tags: patch, security Found i ...

References

CWE-20http://www.securityfocus.com/bid/35193http://tomcat.apache.org/security-5.htmlhttp://www.vupen.com/english/advisories/2009/1496http://secunia.com/advisories/35344http://svn.apache.org/viewvc?rev=781362&view=revhttp://securitytracker.com/id?1022331http://secunia.com/advisories/35326http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-4.htmlhttp://svn.apache.org/viewvc?rev=742915&view=revhttp://jvn.jp/en/jp/JVN87272440/index.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:138http://www.mandriva.com/security/advisories?name=MDVSA-2009:136http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://secunia.com/advisories/35685http://secunia.com/advisories/35788http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1http://www.vupen.com/english/advisories/2009/1856https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.htmlhttp://www.vupen.com/english/advisories/2009/3316http://secunia.com/advisories/37460http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://support.apple.com/kb/HT4077http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://marc.info/?l=bugtraq&m=129070310906557&w=2http://www.vupen.com/english/advisories/2010/3056http://secunia.com/advisories/42368http://www.debian.org/security/2011/dsa-2207http://marc.info/?l=bugtraq&m=136485229118404&w=2http://marc.info/?l=bugtraq&m=133469267822771&w=2http://marc.info/?l=bugtraq&m=127420533226623&w=2https://exchange.xforce.ibmcloud.com/vulnerabilities/50928https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5739https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19110https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10231http://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/504044/100/0/threadedhttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3Ehttp://tools.cisco.com/security/center/viewAlert.x?alertId=18414https://nvd.nist.govhttps://usn.ubuntu.com/788-1/