April 25, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – ProClient RAT with Advanced Espionage Features
March 3, 2020Rewterz Threat Advisory – CVE-2020-6420 – Google Chrome security bypass Vulnerability
March 4, 2020Rewterz Threat Alert – ProClient RAT with Advanced Espionage Features
March 3, 2020Rewterz Threat Advisory – CVE-2020-6420 – Google Chrome security bypass Vulnerability
March 4, 2020
Severity
High
Analysis Summary
Ongoing scans for Apache Tomcat servers unpatched against the Ghostcat vulnerability that allows potential attackers to take over servers have been detected over the weekend. Researchers said “mass scanning activity targeting this vulnerability has already begun. PATCH NOW!”
CVE-2020-1938
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. Prior to Tomcat 7.0.100, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required.
Impact
Server takeover
Affected Vendors
Apache Tomcat
Affected Products
All unpatched Apache Tomcat 6 7 8 and 9 installations ship with AJP Connector enabled by default.
Remediation
| The Apache Tomcat developers have released versions 7.0.100, 8.5.51, and 9.0.31 to patch the vulnerability. |