Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.702725
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 2725-1 (tomcat6 - several vulnerabilities)
Summary:Two security issues have been found in the Tomcat servlet and JSP engine:;;CVE-2012-3544;The input filter for chunked transfer encodings could trigger high;resource consumption through malformed CRLF sequences, resulting in;denial of service.;;CVE-2013-2067;The FormAuthenticator module was vulnerable to session fixation.
Description:Summary:
Two security issues have been found in the Tomcat servlet and JSP engine:

CVE-2012-3544
The input filter for chunked transfer encodings could trigger high
resource consumption through malformed CRLF sequences, resulting in
denial of service.

CVE-2013-2067
The FormAuthenticator module was vulnerable to session fixation.

Affected Software/OS:
tomcat6 on Debian Linux

Solution:
For the oldstable distribution (squeeze), these problems have been fixed in
version 6.0.35-1+squeeze3. This update also provides fixes for
CVE-2012-2733,
CVE-2012-3546,
CVE-2012-4431,
CVE-2012-4534,
CVE-2012-5885,
CVE-2012-5886 and
CVE-2012-5887
,
which were all fixed for stable already.

For the stable distribution (wheezy), these problems have been fixed in
version 6.0.35-6+deb7u1.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your tomcat6 packages.

CVSS Score:
6.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2012-4534
BugTraq ID: 56813
http://www.securityfocus.com/bid/56813
Bugtraq: 20121204 CVE-2012-4534 Apache Tomcat denial of service (Google Search)
http://archives.neohapsis.com/archives/bugtraq/2012-12/0043.html
HPdes Security Advisory: HPSBMU02873
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878
HPdes Security Advisory: HPSBST02955
http://marc.info/?l=bugtraq&m=139344343412337&w=2
HPdes Security Advisory: HPSBUX02866
http://marc.info/?l=bugtraq&m=136612293908376&w=2
HPdes Security Advisory: SSRT101139
HPdes Security Advisory: SSRT101182
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19398
RedHat Security Advisories: RHSA-2013:0623
http://rhn.redhat.com/errata/RHSA-2013-0623.html
http://www.securitytracker.com/id?1027836
http://secunia.com/advisories/57126
SuSE Security Announcement: openSUSE-SU-2013:0161 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-01/msg00051.html
SuSE Security Announcement: openSUSE-SU-2013:0170 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-01/msg00061.html
SuSE Security Announcement: openSUSE-SU-2013:0192 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-01/msg00080.html
http://www.ubuntu.com/usn/USN-1685-1
Common Vulnerability Exposure (CVE) ID: CVE-2012-3544
BugTraq ID: 59797
http://www.securityfocus.com/bid/59797
BugTraq ID: 64758
http://www.securityfocus.com/bid/64758
Bugtraq: 20130510 [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited (Google Search)
http://archives.neohapsis.com/archives/bugtraq/2013-05/0042.html
Bugtraq: 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (Google Search)
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://seclists.org/fulldisclosure/2014/Dec/23
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
http://www.ubuntu.com/usn/USN-1841-1
Common Vulnerability Exposure (CVE) ID: CVE-2013-2067
BugTraq ID: 59799
http://www.securityfocus.com/bid/59799
Bugtraq: 20130510 [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator (Google Search)
http://archives.neohapsis.com/archives/bugtraq/2013-05/0041.html
RedHat Security Advisories: RHSA-2013:0833
http://rhn.redhat.com/errata/RHSA-2013-0833.html
RedHat Security Advisories: RHSA-2013:0834
http://rhn.redhat.com/errata/RHSA-2013-0834.html
RedHat Security Advisories: RHSA-2013:0839
http://rhn.redhat.com/errata/RHSA-2013-0839.html
RedHat Security Advisories: RHSA-2013:0964
http://rhn.redhat.com/errata/RHSA-2013-0964.html
RedHat Security Advisories: RHSA-2013:1437
http://rhn.redhat.com/errata/RHSA-2013-1437.html
Common Vulnerability Exposure (CVE) ID: CVE-2012-5885
BugTraq ID: 56403
http://www.securityfocus.com/bid/56403
HPdes Security Advisory: HPSBUX02860
http://marc.info/?l=bugtraq&m=136485229118404&w=2
HPdes Security Advisory: SSRT101146
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19432
RedHat Security Advisories: RHSA-2013:0629
http://rhn.redhat.com/errata/RHSA-2013-0629.html
RedHat Security Advisories: RHSA-2013:0631
http://rhn.redhat.com/errata/RHSA-2013-0631.html
RedHat Security Advisories: RHSA-2013:0632
http://rhn.redhat.com/errata/RHSA-2013-0632.html
RedHat Security Advisories: RHSA-2013:0633
http://rhn.redhat.com/errata/RHSA-2013-0633.html
RedHat Security Advisories: RHSA-2013:0640
http://rhn.redhat.com/errata/RHSA-2013-0640.html
RedHat Security Advisories: RHSA-2013:0647
http://rhn.redhat.com/errata/RHSA-2013-0647.html
RedHat Security Advisories: RHSA-2013:0648
http://rhn.redhat.com/errata/RHSA-2013-0648.html
RedHat Security Advisories: RHSA-2013:0726
http://rhn.redhat.com/errata/RHSA-2013-0726.html
http://secunia.com/advisories/51371
SuSE Security Announcement: openSUSE-SU-2012:1700 (Google Search)
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
SuSE Security Announcement: openSUSE-SU-2012:1701 (Google Search)
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
SuSE Security Announcement: openSUSE-SU-2013:0147 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
http://www.ubuntu.com/usn/USN-1637-1
XForce ISS Database: tomcat-replay-security-bypass(80408)
https://exchange.xforce.ibmcloud.com/vulnerabilities/80408
Common Vulnerability Exposure (CVE) ID: CVE-2012-5887
XForce ISS Database: tomcat-digest-security-bypass(79809)
https://exchange.xforce.ibmcloud.com/vulnerabilities/79809
Common Vulnerability Exposure (CVE) ID: CVE-2012-4431
BugTraq ID: 56814
http://www.securityfocus.com/bid/56814
Bugtraq: 20121204 CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter (Google Search)
http://archives.neohapsis.com/archives/bugtraq/2012-12/0045.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18541
RedHat Security Advisories: RHSA-2013:0267
http://rhn.redhat.com/errata/RHSA-2013-0267.html
RedHat Security Advisories: RHSA-2013:0268
http://rhn.redhat.com/errata/RHSA-2013-0268.html
RedHat Security Advisories: RHSA-2013:1853
http://rhn.redhat.com/errata/RHSA-2013-1853.html
http://www.securitytracker.com/id?1027834
Common Vulnerability Exposure (CVE) ID: CVE-2012-2733
BugTraq ID: 56402
http://www.securityfocus.com/bid/56402
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19218
http://www.securitytracker.com/id?1027729
Common Vulnerability Exposure (CVE) ID: CVE-2012-5886
XForce ISS Database: tomcat-http-Digest-security-bypass(80407)
https://exchange.xforce.ibmcloud.com/vulnerabilities/80407
Common Vulnerability Exposure (CVE) ID: CVE-2012-3546
BugTraq ID: 56812
http://www.securityfocus.com/bid/56812
Bugtraq: 20121204 CVE-2012-3546 Apache Tomcat Bypass of security constraints (Google Search)
http://archives.neohapsis.com/archives/bugtraq/2012-12/0044.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19305
RedHat Security Advisories: RHSA-2013:0004
http://rhn.redhat.com/errata/RHSA-2013-0004.html
RedHat Security Advisories: RHSA-2013:0005
http://rhn.redhat.com/errata/RHSA-2013-0005.html
RedHat Security Advisories: RHSA-2013:0146
http://rhn.redhat.com/errata/RHSA-2013-0146.html
RedHat Security Advisories: RHSA-2013:0147
http://rhn.redhat.com/errata/RHSA-2013-0147.html
RedHat Security Advisories: RHSA-2013:0151
http://rhn.redhat.com/errata/RHSA-2013-0151.html
RedHat Security Advisories: RHSA-2013:0157
http://rhn.redhat.com/errata/RHSA-2013-0157.html
RedHat Security Advisories: RHSA-2013:0158
http://rhn.redhat.com/errata/RHSA-2013-0158.html
RedHat Security Advisories: RHSA-2013:0162
http://rhn.redhat.com/errata/RHSA-2013-0162.html
RedHat Security Advisories: RHSA-2013:0163
http://rhn.redhat.com/errata/RHSA-2013-0163.html
RedHat Security Advisories: RHSA-2013:0164
http://rhn.redhat.com/errata/RHSA-2013-0164.html
RedHat Security Advisories: RHSA-2013:0191
http://rhn.redhat.com/errata/RHSA-2013-0191.html
RedHat Security Advisories: RHSA-2013:0192
http://rhn.redhat.com/errata/RHSA-2013-0192.html
RedHat Security Advisories: RHSA-2013:0193
http://rhn.redhat.com/errata/RHSA-2013-0193.html
RedHat Security Advisories: RHSA-2013:0194
http://rhn.redhat.com/errata/RHSA-2013-0194.html
RedHat Security Advisories: RHSA-2013:0195
http://rhn.redhat.com/errata/RHSA-2013-0195.html
RedHat Security Advisories: RHSA-2013:0196
http://rhn.redhat.com/errata/RHSA-2013-0196.html
RedHat Security Advisories: RHSA-2013:0197
http://rhn.redhat.com/errata/RHSA-2013-0197.html
RedHat Security Advisories: RHSA-2013:0198
http://rhn.redhat.com/errata/RHSA-2013-0198.html
RedHat Security Advisories: RHSA-2013:0221
http://rhn.redhat.com/errata/RHSA-2013-0221.html
RedHat Security Advisories: RHSA-2013:0235
http://rhn.redhat.com/errata/RHSA-2013-0235.html
RedHat Security Advisories: RHSA-2013:0641
http://rhn.redhat.com/errata/RHSA-2013-0641.html
RedHat Security Advisories: RHSA-2013:0642
http://rhn.redhat.com/errata/RHSA-2013-0642.html
http://www.securitytracker.com/id?1027833
http://secunia.com/advisories/51984
http://secunia.com/advisories/52054
CopyrightCopyright (C) 2013 Greenbone Networks GmbH http://greenbone.net

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.