My company's McAfee system detected many "http CSH bash ShellShock code injection attacks" attempts on a Windows 2008 server running Apache Tomcat Coyote. Does this config present a potential attack on the server or is it just an attempt that could not harm the system while it is on a Windows machine ?
However, Apache Tomcat, when running on windows, does not include bash by default and doesn't have CGI enabled by default either.
So, generally speaking, no, Apache Tomcat running under windows is not vulnerable. To be sure, however, you have to verify that bash hasn't been installed and used as the interpreter for CGI programs (which is sometimes done by third parties to deploy Unix software on Windows).