PT-2012-4798 · Apache+1 · Apache Tomcat+1

Saran Neti · Published 2012-12-31 · Updated 2022-05-14 · CVE-2012-3544

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.36 Apache Tomcat versions 7.0.0 through 7.0.29

Description The issue allows remote attackers to cause a denial of service by streaming data due to improper handling of chunk extensions in chunked transfer coding.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.36, update to version 6.0.37 or later. For Apache Tomcat versions 7.0.0 through 7.0.29, update to version 7.0.30 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-3544

DSA-2725-1

DSA-2897-1

GHSA-QFXV-3PPC-7QG5

MGASA-2014-0082

RHSA-2013:1011

RHSA-2013:1012

SUSE-SU-2014_1015-1

USN-1841-1

Affected Products

Apache Tomcat

Suse

References · 44

• https://cve.org/CVERecord?id=CVE-2012-3544 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3544 · Security Note
• http://svn.apache.org/viewvc?view=revision&revision=1378702 · Patch
• http://svn.apache.org/viewvc?view=revision&revision=1378921 · Patch
• http://ubuntu.com/usn/USN-1841-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1841-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0082.html · Security Note
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0082 · Vendor Advisory
• http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592&r2=1476591&pathrev=1476592 · Patch
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qfxv-3ppc-7qg5 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1476592 · Patch
• https://ubuntu.com/security/CVE-2012-3544 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3544 · Vendor Advisory