PT-2014-3546 · Apache+5 · Apache Tomcat+5

Published 2014-06-24 · Updated 2022-05-14 · CVE-2014-0227

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.41 Apache Tomcat versions 7.0.0 through 7.0.54 Apache Tomcat versions 8.0.0 through 8.0.8

Description The issue allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service by streaming data with malformed chunked transfer coding. This is due to the improper handling of attempts to continue reading data after an error has occurred in the java/org/apache/coyote/http11/filters/ChunkedInputFilter.java file. It was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.41, update to version 6.0.42 or later. For Apache Tomcat versions 7.0.0 through 7.0.54, update to version 7.0.55 or later. For Apache Tomcat versions 8.0.0 through 8.0.8, update to version 8.0.9 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-19

CWE-20

Related Identifiers

CESA-2015_0983

CESA-2015_0991

CVE-2014-0227

DLA-232-1

DSA-3447-1

DSA-3530-1

GHSA-42J3-498Q-M6VP

HPSBUX03337

HPSBUX03341

MGASA-2015-0081

RHSA-2014:1019

RHSA-2014:1020

RHSA-2014:1087

RHSA-2014:1088

RHSA-2015:0983

RHSA-2015:0991

RHSA-2015_0983

RHSA-2015_0991

SUSE-SU-2015:1565-1

SUSE-SU-2015_1337-1

SUSE-SU-2015_1565-1

USN-2654-1

USN-2655-1

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

Ubuntu

References · 78

• https://nvd.nist.gov/vuln/detail/CVE-2014-0227 · Security Note
• http://marc.info/?l=bugtraq&m=143393515412274&w=2 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0765.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=143403519711434&w=2 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0983.html · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2655-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3447-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-0983.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0227 · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0991.html · Vendor Advisory