Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability

Bugtraq ID:	34412
Class:	Design Error
CVE:	CVE-2008-5519
Remote:	Yes
Local:	No
Published:	Apr 07 2009 12:00AM
Updated:	Jan 12 2010 05:11PM
Credit:	Red Hat Security Response Team <br><br>
Vulnerable:	SuSE SUSE Linux Enterprise 11 SuSE Linux 9 SuSE Linux 11 SuSE Linux 10.0 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 10_x86 Sun Solaris 10 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.3 Redhat Red Hat Network Satellite (for RHEL 4) 5.1 Redhat Network Satellite (for RHEL 4 AS) 5.2 Redhat Application Stack v2 0 Redhat Application Server WS4 2 Redhat Application Server ES4 2 Redhat Application Server AS4 2 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Apache mod_jk 1.2.26 Apache mod_jk 1.2.25 Apache mod_jk 1.2.21 Apache mod_jk 1.2.20 Apache mod_jk 1.2.19 Apache mod_jk 1.2.18 Apache mod_jk 1.2.15 Apache mod_jk 1.2.14 .1 Apache mod_jk 1.2.14 .1 Apache mod_jk 1.2.1 Apache mod_jk 1.2
Not Vulnerable:	Apache mod_jk 1.2.27

Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability

The 'mod_jk' module for Apache Tomcat is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

This issue affects mod_jk 1.2.0 through 1.2.26.

Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability

An attacker can exploit this issue through a browser.

Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 arm

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_arm.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_arm.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_arm.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_arm.deb

Debian Linux 5.0 ia-64

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_ia64.deb

Debian Linux 4.0 powerpc

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_powerpc.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_powerpc.deb

Debian Linux 4.0 m68k

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb

Sun Solaris 10_x86

• Sun 122912-16
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -122912-16-1

Debian Linux 5.0 alpha

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_alpha.deb

Debian Linux 5.0 ia-32

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_i386.deb

Debian Linux 5.0 s/390

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_s390.deb

Debian Linux 5.0 mipsel

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_mipsel.deb

Sun Solaris 10

• Sun 122911-16
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -122911-16-1

Debian Linux 4.0 amd64

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_amd64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_amd64.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_amd64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_amd64.deb

Debian Linux 4.0 ia-32

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_i386.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_i386.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_i386.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_i386.deb

Debian Linux 5.0 hppa

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_hppa.deb

Sun Solaris 9

• Sun 114016-04
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114016-04-1

Debian Linux 4.0 hppa

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_hppa.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_hppa.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_hppa.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_hppa.deb

Debian Linux 4.0 sparc

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_sparc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_sparc.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_sparc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_sparc.deb

Sun Solaris 9_x86

• Sun 114017-04
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114017-04-1

Debian Linux 4.0 s/390

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_s390.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_s390.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_s390.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_s390.deb

Debian Linux 5.0 m68k

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb

Debian Linux 5.0 arm

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_arm.deb

Debian Linux 4.0 alpha

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_alpha.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_alpha.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_alpha.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_alpha.deb

Debian Linux 4.0 armel

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb

Debian Linux 5.0 armel

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_armel.deb

Debian Linux 5.0

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb

Debian Linux 4.0

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb

Debian Linux 4.0 mipsel

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_mipsel.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_mipsel.deb

Debian Linux 5.0 amd64

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_amd64.deb

Debian Linux 5.0 mips

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_mips.deb

Debian Linux 5.0 powerpc

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_powerpc.deb

Debian Linux 4.0 ia-64

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_ia64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_ia64.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_ia64.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_ia64.deb

Debian Linux 4.0 mips

• Debian libapache-mod-jk-doc_1.2.18-3etch2_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.18-3etch2_all.deb


• Debian libapache-mod-jk_1.2.18-3etch2_mips.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk_1.2.18-3etch2_mips.deb


• Debian libapache2-mod-jk_1.2.18-3etch2_mips.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.18-3etch2_mips.deb

Debian Linux 5.0 sparc

• Debian libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache-mod-jk-doc_1.2.26-2+lenny1_all.deb


• Debian libapache2-mod-jk_1.2.26-2+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/liba/libapache-mod-jk/lib apache2-mod-jk_1.2.26-2+lenny1_sparc.deb

Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability

References:

• Tomcat Connectors (mod_jk) Downloads (Apache Software Foundation)
  
• [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerabi (Mark Thomas )
  
• 262468 Security Vulnerability in the Apache 1.3 (Sun)