Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
From: Mark Thomas <markt () apache org>
Date: Tue, 27 May 2014 14:08:43 +0100

CORRECTION: This is CVE-2014-0099 *NOT* -0097
            Apologies for the typo

On 27/05/2014 13:46, Mark Thomas wrote:
CVE-2014-0099 Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.3
- Apache Tomcat 7.0.0 to 7.0.52
- Apache Tomcat 6.0.0 to 6.0.39

Description:
The code used to parse the request content length header did not check
for overflow in the result. This exposed a request smuggling
vulnerability when Tomcat was located behind a reverse proxy that
correctly processed the content length header.

Mitigation:
Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 8.0.5 or later
  (8.0.4 contains the fix but was not released)
- Upgrade to Apache Tomcat 7.0.53 or later
- Upgrade to Apache Tomcat 6.0.41 or later
  (6.0.40 contains the fix but was not released)

Credit:
A test case that demonstrated the parsing bug was sent to the Tomcat
security team but no context was provided. The security implications
were identified by the Tomcat security team .

References:
[1] http://tomcat.apache.org/security-8.html
[2] http://tomcat.apache.org/security-7.html
[3] http://tomcat.apache.org/security-6.html

---------------------------------------------------------------------
To unsubscribe, e-mail: security-unsubscribe () tomcat apache org
For additional commands, e-mail: security-help () tomcat apache org



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]