| Description: | Summary:
Apache Tomcat is prone to multiple vulnerabilities.
Vulnerability Insight:
The following vulnerabilities exist:
- CVE-2012-4431: The CSRF prevention filter could be bypassed if a request was made to a
protected resource without a session identifier present in the request.
- CVE-2012-2733: The checks that limited the permitted size of request headers were implemented
too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user
to trigger an OutOfMemoryError by sending a single request with very large headers.
- CVE-2012-4534: When using the NIO connector with sendfile and HTTPS enabled, if a client breaks
the connection while reading the response an infinite loop is entered leading to a denial of
service.
- CVE-2012-3439: DIGEST authentication weakness
- CVE-2012-3546: When using FORM authentication it was possible to bypass the security constraint
checks in the FORM authenticator by appending /j_security_check to the end of the URL if some
other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before
the call to FormAuthenticator#authenticate().
Affected Software/OS:
Apache Tomcat version 6.0.x through 6.0.35.
Solution:
Update to version 6.0.36 or later.
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
