Certain HTTP request could confuse the JK connector in Apache Tomcat which could result in a user seeing responses destined for other users (CVE-2008-5519).

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Nov/12/15

SunOS 5.9: tomcat security patch.
Date this patch was last updated by Sun : Jul/27/11

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/29/16

SunOS 5.9_x86: tomcat security patch.
Date this patch was last updated by Sun : May/27/11

The remote host is affected by the vulnerability described in GLSA-200906-04 (Apache Tomcat JK Connector: Information disclosure)

    The Red Hat Security Response Team discovered that mod_jk does not     properly handle (1) requests setting the 'Content-Length' header while     not providing data and (2) clients sending repeated requests very     quickly.
  Impact :

    A remote attacker could send specially crafted requests or a large     number of requests at a time, possibly resulting in the disclosure of a     response intended for another client.
  Workaround :

    There is no known workaround at this time.

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/15/14

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/29/16

An information disclosure flaw was found in mod_jk, the Tomcat Connector module for Apache. If a buggy client included the 'Content-Length' header without providing request body data, or if a client sent repeated requests very quickly, one client could obtain a response intended for another client.

The oldstable distribution (etch), this problem has been fixed in version 1:1.2.18-3etch2.

An updated mod_jk package that fixes one security issue is now available for Red Hat Network Satellite Server 5.1 and 5.2.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_jk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other.

An information disclosure flaw was found in mod_jk. In certain situations, if a faulty client set the 'Content-Length' header without providing data, or if a user sent repeated requests very quickly, one user may view a response intended for another user. (CVE-2008-5519)

Note: Red Hat Network Satellite Server is the only client that has access to mod_jk on the system, and as such, the exposure and risk of this issue is low.

Users of Red Hat Network Satellite Server 5.1 and 5.2 are advised to upgrade to this updated mod_jk package, which contains a backported patch to correct this issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42389	openSUSE Security Update : apache2-mod_jk (apache2-mod_jk-1479)	Nessus	SuSE Local Security Checks	2009/11/5	2021/1/14	low
107886	Solaris 10 (x86) : 122912-35	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
13547	Solaris 9 (sparc) : 114016-08	Nessus	Solaris Local Security Checks	2004/7/12	2021/1/14	low
42392	openSUSE Security Update : apache2-mod_jk (apache2-mod_jk-1479)	Nessus	SuSE Local Security Checks	2009/11/5	2021/1/14	low
107888	Solaris 10 (x86) : 122912-37	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
13588	Solaris 9 (x86) : 114017-07	Nessus	Solaris Local Security Checks	2004/7/12	2021/1/14	low
39571	GLSA-200906-04 : Apache Tomcat JK Connector: Information disclosure	Nessus	Gentoo Local Security Checks	2009/6/30	2021/1/6	low
107382	Solaris 10 (sparc) : 122911-33	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
107386	Solaris 10 (sparc) : 122911-37	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
38991	Debian DSA-1810-1 : libapache-mod-jk - information disclosure	Nessus	Debian Local Security Checks	2009/6/3	2021/1/4	low
42397	openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-6599)	Nessus	SuSE Local Security Checks	2009/11/5	2021/1/14	low
43846	RHEL 4 : mod_jk in Satellite Server (RHSA-2009:1618)	Nessus	Red Hat Local Security Checks	2010/1/10	2021/1/14	low

检测

插件搜索

low

medium

low

low

medium

low

low

medium

medium

low

low

low