Eol/obsolete software apache tomcat 5.5.x detected

Note: This issue is also known as CVE In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1. A flaw was found in the handling of the scoreboard.

An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly. A flaw was found in the default error response for status code This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified. Given a specific configuration, a remote attacker could send certain requests, putting a backend server into an error state until the retry timeout expired.

This could lead to a temporary denial of service. Given a specific configuration, a remote attacker could send certain malformed HTTP requests, putting a backend server into an error state until the retry timeout expired. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially-crafted Range header. This could be used in a denial of service attack. Advisory: CVE Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack.

Resolution: Update APR to release 1. A buffer over-read flaw was found in the bundled expat library. This crash would only be a denial of service if using the worker MPM. A remote attacker could send requests, carefully crafting the timing of individual bytes, which would slowly consume memory, potentially leading to a denial of service.

A malicious remote attacker could send a carefully crafted request and cause a httpd child process to crash. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. Acknowledgements: We would like to thank Loren Anderson for the detailed analysis and reporting of this issue.

A remote attacker could send malicious requests to trigger this issue, resulting in denial of service. Acknowledgements: We would like to thank Niku Toivola of Sulake Corporation for reporting and proposing a patch fix for this issue. This could leave the callbacks in an undefined state and result in a segfault. Acknowledgements: We would like to thank Brett Gervasoni of Sense of Security for reporting and proposing a patch fix for this issue. Acknowledgements: We would like to thank Philip Pickett of VMware for reporting and proposing a fix for this issue.

A remote attacker could trigger this issue on Solaris servers which used prefork or event MPMs, resulting in a denial of service.

A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service.

In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server. A heap-based underwrite flaw was found in the way the bundled copy of the APR-util library created compiled forms of particular search patterns.

I am not getting things properly to move further! How we can eliminate these old VS Vulnerabilities and what is the impact. Could you please help? DeepakHadpad The Microsoft Security Response Center releases security bulletins on a monthly basis addressing security vulnerabilities in Microsoft software, describing their remediation, and providing links to the applicable updates for affected software. Each security bulletin is accompanied by one or more unique Knowledge Base Articles to provide further information about the updates.

If you want to know if a security bulletin will impact on your SharePoint farm, you can check the related security bulletin and KB. If an Answer is helpful, please click " Accept Answer " and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. A t tachments 0 Page History People who can view.

Copy Page Tree. Jira links. Spec versions: Servlet 4. Spec versions: Servlet 3. Spec versions: Servlet 2. Content Tools.