PT-2014-3548 · Apache+4 · Apache Tomcat+4

Publicado 2014-06-24 · Atualizado 2022-05-14 · CVE-2014-0230

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.x through 6.0.43 Apache Tomcat versions 7.x through 7.0.54 Apache Tomcat versions 8.x through 8.0.8

Description The issue arises when an HTTP response occurs before the entire request body has been read, allowing remote attackers to cause a denial of service by consuming threads through a series of aborted upload attempts. By default, Tomcat swallows the remaining request body so that the next request on the connection may be processed, but there was no limit to the size of the request body that Tomcat would swallow, permitting a limited Denial of Service.

Recommendations For Apache Tomcat version 6.x, update to version 6.0.44 or later. For Apache Tomcat version 7.x, update to version 7.0.55 or later. For Apache Tomcat version 8.x, update to version 8.0.9 or later.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

CESA-2016_2599

CVE-2014-0230

DLA-232-1

DSA-3447-1

DSA-3530-1

GHSA-PXCX-CXQ8-4MMW

RHSA-2015:1622

RHSA-2015:2659

RHSA-2015:2660

RHSA-2016:0595

RHSA-2016:0596

RHSA-2016:0597

RHSA-2016:0598

RHSA-2016:2599

RHSA-2016_2599

SUSE-SU-2015:1565-1

USN-2654-1

USN-2655-1

Produtos afetados

Apache Tomcat

Centos

Red Hat

Suse

Ubuntu

Referências · 83

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/6b2cfacf749be186ea77249a979af1d4863e47ba · Nota
• https://github.com/apache/tomcat/commit/c1357e649641844109711d60cacb98e4b5fcd3cb · Nota
• https://github.com/apache/tomcat/commit/b1c8477e3e3ee635d19cc4d5987c2b157431e0c1 · Nota
• https://github.com/apache/tomcat/commit/fc049912464f0dcf9dede3761f38049369057e16 · Nota
• https://github.com/apache/tomcat/commit/fdd9f11dc24b95e5425076abb58e968336f320a2 · Nota
• https://github.com/apache/tomcat/commit/e28dd578fad90a6d5726ec34f3245c9f99d909a5 · Nota
• https://github.com/apache/tomcat/commit/812088583d0e60717a8fe9c6d14e12bcdc3e6c51 · Nota
• https://github.com/apache/tomcat/commit/e3146f4b03a2386c3e57597e86134d4ed5c31303 · Nota
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · Nota
• https://bugzilla.suse.com/932698 · Nota
• http://marc.info/?l=bugtraq&m=145974991225029&w=2 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pxcx-cxq8-4mmw · Aviso do Fabricante
• https://tomcat.apache.org/security-8 · Nota
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Nota