Detections
Analytics

Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS

medium Nessus Plugin ID 11519

Language:

Synopsis

The remote web server module has a denial of service vulnerability.

Description

According to the banner, the remote host is using a vulnerable version of the Apache mod_jk module. Such versions have a bug that could allow a remote attacker to use chunked encoding requests to desynchronize Apache and Tomcat, and therefore prevent the remote web server from working properly.

Solution

Upgrade to mod_jk 1.2.1 or later.

See Also

https://seclists.org/bugtraq/2002/Dec/47

Plugin Details

Severity: Medium

ID: 11519

File Name: mod_jk_chunked_encoding_dos.nasl

Version: 1.22

Type: remote

Family: Web Servers

Published: 4/4/2003

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 12/4/2002

Reference Information

CVE: CVE-2002-2272

BID: 6320

CWE: 119