Apache Affected

Notified:  January 20, 2005 Updated: March 01, 2005

Status

Affected

Vendor Statement

The Apache Software Foundation acknowledge that Tomcat 3.x can be remotely caused to crash or shutdown by a connection sending the right sequence of bytes to the AP12 protcol port (TCP 8007 by default). Tomcat 3.x users are advised to ensure that this port is adequately firewalled to ensure that it is not accessible to remote attackers. We do not plan on issuing updates to Tomcat 3.x for this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

Hitachi Affected

Updated:  March 10, 2005

Status

Affected

Vendor Statement

Hitachi Cosminexus Server Component Container (for Java) 02-00 to 02-00-/L is vulnerable to this issue. More details are available at http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.