CVE-2008-5519: Infoleak

Published Mar 13, 2009

Updated

An issue with modjk 1.2.26, and possibly older versions, allows one user to see another user's information due to missing logic where faulty clients set Content-Length without providing data, or if a user submits too many times very fast.

The relevant changelog entry in modjk 1.2.27 that corrects the issue is:

"AJP13: Always send initial POST packet even if the client disconnected after sending request but before providing POST data. In that case or in case the client broke the connection in a middle of read send an zero size packet informing container about broken client connection. (mturk)"

from http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

Other sources

The JK Connector (aka modjk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Affected Software

128 affected components

Apache Mod Jk=1.2.11

Apache Mod Jk=1.2.25

Apache Mod Jk=1.2.9

Apache Mod Jk=1.2.19

Apache Mod Jk=1.2.23

Apache Mod Jk=1.2.16

Apache Mod Jk=1.2.6

Apache Mod Jk=1.2.17

Apache Mod Jk=1.2.24

Apache Mod Jk=1.2.22

Apache Mod Jk=1.2

Apache Mod Jk=1.2.13

Apache Mod Jk=1.2.8

Apache Mod Jk=1.2.10

Apache Mod Jk=1.2.7

Apache Mod Jk=1.2.20

Apache Mod Jk=1.2.21

Apache Mod Jk=1.2.1

Apache Mod Jk=1.2.15

Apache Mod Jk=1.2.12

Apache Mod Jk=1.2.14.1

Apache Mod Jk=1.2.14

Apache Mod Jk=1.2.18

Apache Mod Jk=1.2.26

Apache Tomcat=5.5.27

Apache Tomcat=4.1.2

Apache Tomcat=4.0.4

Apache Tomcat=4.1.35

Apache Tomcat=4.1.36

Apache Tomcat=4.1.9-beta

Apache Tomcat=5.5.18

Apache Tomcat=5.0.8

Apache Tomcat=5.0.19

Apache Tomcat=4.1.21

Apache Tomcat=5.5.12

Apache Tomcat=5.0.14

Apache Tomcat=5.5.14

Apache Tomcat=4.1.24

Apache Tomcat=5.5.10

Apache Tomcat=5.0.22

Apache Tomcat=5.5.4

Apache Tomcat=5.5.7

Apache Tomcat=5.5.1

Apache Tomcat=5.0.7

Apache Tomcat=5.5.11

Apache Tomcat=4.1.25

Apache Tomcat=5.5.6

Apache Tomcat=5.5.26

Apache Tomcat=5.0.9

Apache Tomcat=4.1.4

Apache Tomcat=5.0.15

Apache Tomcat=5.0.30

Apache Tomcat=5.5.20

Apache Tomcat=5.5.15

Apache Tomcat=5.0.23

Apache Tomcat=5.0.2

Apache Tomcat=5.5.5

Apache Tomcat=5.0.10

Apache Tomcat=4.1.27

Apache Tomcat=4.1.30

Apache Tomcat=4.1.7

Apache Tomcat=4.1.11

Apache Tomcat=5.0.21

Apache Tomcat=5.0.26

Apache Tomcat=5.5.21

Apache Tomcat=4.1.18

Apache Tomcat=5.5.22

Apache Tomcat=4.1.14

Apache Tomcat=4.1.19

Apache Tomcat=5.0.0

Apache Tomcat=5.0.6

Apache Tomcat=4.1.31

Apache Tomcat=5.5.3

Apache Tomcat=5.0.27

Apache Tomcat=4.1.16

Apache Tomcat=4.1.29

Apache Tomcat=5.0.16

Apache Tomcat=4.1.22

Apache Tomcat=4.0.6

Apache Tomcat=4.1.5

Apache Tomcat=4.1.26

Apache Tomcat=4.1.13

Apache Tomcat=4.1.8

Apache Tomcat=5.5.9

Apache Tomcat=4.0.3

Apache Tomcat=5.5.25

Apache Tomcat=5.0.18

Apache Tomcat=4.1.17

Apache Tomcat=4.0.1

Apache Tomcat=5.5.2

Apache Tomcat=5.0.5

Apache Tomcat=5.0.28

Apache Tomcat=5.0.29

Apache Tomcat=4.1.33

Apache Tomcat=5.5.0

Apache Tomcat=4.1.1

Apache Tomcat=5.5.13

Apache Tomcat=5.5.24

Apache Tomcat=4.1.12

Apache Tomcat=4.1.28

Apache Tomcat=5.0.13

Apache Tomcat=4.1.15

Apache Tomcat=4.1.3-beta

Apache Tomcat=4.1.10

Apache Tomcat=5.5.8

Apache Tomcat=5.0.17

Apache Tomcat=5.5.16

Apache Tomcat=4.1.0

Apache Tomcat=4.1.20

Apache Tomcat=4.0.2

Apache Tomcat=5.5.17

Apache Tomcat=4.1.3

Apache Tomcat=5.5.19

Apache Tomcat=4.0.5

Apache Tomcat=4.1.23

Apache Tomcat=4.0.0

Apache Tomcat=4.1.34

Apache Tomcat=5.0.4

Apache Tomcat=4.1.32

Apache Tomcat=5.0.25

Apache Tomcat=5.0.1

Apache Tomcat=5.0.11

Apache Tomcat=5.5.23

Apache Tomcat=4.1.6

Apache Tomcat=5.0.3

Apache Tomcat=5.0.24

Apache Tomcat=4.1.9

Apache Tomcat=5.0.12

Event History

Mar 13, 2009

Data Sourced

07:21 PM

DescriptionSeverityAffected Software

Apr 9, 2009

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-5519?

CVE-2008-5519 has been classified as a medium severity vulnerability.

How do I fix CVE-2008-5519?

To mitigate CVE-2008-5519, upgrade to mod_jk version 1.2.27 or later.

What versions are affected by CVE-2008-5519?

CVE-2008-5519 affects mod_jk versions prior to 1.2.27, including 1.2.26 and earlier.

What type of data is exposed in CVE-2008-5519?

CVE-2008-5519 allows one user to see another user's information due to improper handling of Content-Length.

What are the potential risks of CVE-2008-5519?

The potential risks of CVE-2008-5519 include unauthorized access to sensitive user information.