Apache Information for VU#204710
Apache Tomcat fails to properly handle certain requests
- Vendor Information Help Date Notified: 20 Jan 2005
- Statement Date:
- Date Updated: 01 Mar 2005
The Apache Software Foundation acknowledge that Tomcat 3.x can be remotely caused to crash or shutdown by a connection sending the right sequence of bytes to the AP12 protcol port (TCP 8007 by default). Tomcat 3.x users are advised to ensure that this port is adequately firewalled to ensure that it is not accessible to remote attackers. We do not plan on issuing updates to Tomcat 3.x for this issue.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.