PT-2013-4956 · Apache+4 · Apache Tomcat+4

Publicado 2013-12-26 · Atualizado 2022-05-14 · CVE-2013-4322

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.38 Apache Tomcat versions 7.0.0 through 7.0.49 Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC9

Description The issue allows remote attackers to cause a denial of service by streaming data, due to improper handling of chunked transfer coding. This includes handling a large total amount of chunked data or whitespace characters in an HTTP header value within a trailer field. The estimated number of potentially affected devices is not provided.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.38, update to version 6.0.39 or later. For Apache Tomcat versions 7.0.0 through 7.0.49, update to version 7.0.50 or later. For Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC9, update to version 8.0.0-RC10 or later.

Correção

DoS

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

CESA-2014_0429

CVE-2013-4322

DLA-91-1

DSA-2897-1

DSA-3530-1

GHSA-WQ2P-Q66W-Q8GP

MGASA-2014-0148

MGASA-2014-0149

RHSA-2014:0429

RHSA-2014:0525

RHSA-2014:0526

RHSA-2014:0686

RHSA-2014_0429

RHSA-2014_0686

USN-2130-1

Produtos afetados

Apache Tomcat

Centos

Red Hat

Suse

Vmware Vcenter

Referências · 79

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/70dc3b279f7c99136c2c51bce8812508b4893c8b · Nota
• https://github.com/apache/tomcat/commit/bed3a1a0d06a3c787183c6e90f326bbe17e49dd4 · Nota
• https://github.com/apache/tomcat/commit/a91516b80deaf1d0c6e04a7931765fdac34c4ccd · Nota
• https://github.com/apache/tomcat/commit/72613a0e2f88af789c2acc7093c82ff02b95b6d1 · Nota
• https://github.com/apache/tomcat/commit/b8cb9f5f91e9210ca107fd80f3e6acd47531daa7 · Nota
• https://github.com/apache/tomcat/commit/d6a9898125f34e593de426e8c7dabb0f224fc00f · Nota
• https://tomcat.apache.org/security-8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4322 · Nota de Segurança
• http://ubuntu.com/usn/USN-2130-1 · Aviso do Fabricante
• https://web.archive.org/web/20161024215639/http://secunia.com/advisories/59722 · Nota
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E · Nota
• http://tomcat.apache.org/security-6.html · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/cpuoct2014-1972960.html · Nota
• https://linux.oracle.com/errata/ELSA-2014-0429.html · Aviso do Fabricante