Test Kennung:	1.3.6.1.4.1.25623.1.0.802378
Kategorie:	Web Servers
Titel:	Apache Tomcat Hash Collision Denial Of Service Vulnerability
Zusammenfassung:	Apache Tomcat Server is prone to a denial of service (DoS) vulnerability.
Beschreibung:	Summary: Apache Tomcat Server is prone to a denial of service (DoS) vulnerability. Vulnerability Insight: The flaw is due to an error within a hash generation function when computing hash values for form parameter and updating a hash table. This can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request. Vulnerability Impact: Successful exploitation could allow remote attackers to cause a denial of service via a specially crafted form sent in a HTTP POST request. Affected Software/OS: Apache Tomcat version before 5.5.35, 6.x to 6.0.34 and 7.x to 7.0.22 on Windows. Solution: Apply patch or upgrade Apache Tomcat to 5.5.35, 6.0.35, 7.0.23 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4858 BugTraq ID: 51200 http://www.securityfocus.com/bid/51200 CERT/CC vulnerability note: VU#903934 http://www.kb.cert.org/vuls/id/903934 Debian Security Information: DSA-2401 (Google Search) http://www.debian.org/security/2012/dsa-2401 HPdes Security Advisory: HPSBMU02747 http://marc.info/?l=bugtraq&m=133294394108746&w=2 HPdes Security Advisory: HPSBUX02741 http://marc.info/?l=bugtraq&m=132871655717248&w=2 HPdes Security Advisory: HPSBUX02860 http://marc.info/?l=bugtraq&m=136485229118404&w=2 HPdes Security Advisory: SSRT100728 HPdes Security Advisory: SSRT100771 HPdes Security Advisory: SSRT101146 http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886 RedHat Security Advisories: RHSA-2012:0074 http://rhn.redhat.com/errata/RHSA-2012-0074.html RedHat Security Advisories: RHSA-2012:0075 http://rhn.redhat.com/errata/RHSA-2012-0075.html RedHat Security Advisories: RHSA-2012:0076 http://rhn.redhat.com/errata/RHSA-2012-0076.html RedHat Security Advisories: RHSA-2012:0077 http://rhn.redhat.com/errata/RHSA-2012-0077.html RedHat Security Advisories: RHSA-2012:0078 http://rhn.redhat.com/errata/RHSA-2012-0078.html RedHat Security Advisories: RHSA-2012:0089 http://rhn.redhat.com/errata/RHSA-2012-0089.html RedHat Security Advisories: RHSA-2012:0325 http://rhn.redhat.com/errata/RHSA-2012-0325.html RedHat Security Advisories: RHSA-2012:0406 http://rhn.redhat.com/errata/RHSA-2012-0406.html http://secunia.com/advisories/48549 http://secunia.com/advisories/48790 http://secunia.com/advisories/48791 http://secunia.com/advisories/54971 http://secunia.com/advisories/55115
Copyright	Copyright (C) 2012 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.