CVE-2002-1895 - The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector,

CVE-2002-1895

Summary

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.

References

Vulnerable Configurations

cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 25-03-2019 - 11:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

refmap via4

confirm	http://tomcat.apache.org/security-4.html
mlist	[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
vulnwatch	20021011 Apache Tomcat 3.x and 4.0.x: Remote denial-of-service vulnerability
xf	tomcat-get-device-dos(10348)

Last major update

25-03-2019 - 11:29

Published

31-12-2002 - 05:00

Last modified

25-03-2019 - 11:29