PT-2008-1546 · Apache · Apache Tomcat

Published 2008-02-08 · Updated 2022-05-01 · CVE-2007-6286

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.11 through 5.5.25 Apache Tomcat versions 6.0.0 through 6.0.15

Description The issue arises when the native APR connector is used, and an empty request is sent to the SSL port. This can cause the handling of a duplicate copy of one of the recent requests, potentially leading to unintended behavior. This can be demonstrated by using netcat to send an empty request to the SSL port and then disconnecting without sending any data.

Recommendations For Apache Tomcat versions 5.5.11 through 5.5.25, consider disabling the native APR connector until a patch is available. For Apache Tomcat versions 6.0.0 through 6.0.15, consider disabling the native APR connector until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6286

GHSA-QRJ4-RMQG-4HCP

Affected Products

Apache Tomcat

References · 38

• http://marc.info/?l=bugtraq&m=139344343412337&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6286 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:136 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-10.xml · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrj4-rmqg-4hcp · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00460.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00315.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2008-0010.html · Note
• https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E · Note
• http://secunia.com/advisories/28915 · Note
• https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E · Note
• http://securityreason.com/securityalert/3637 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286 · Note