Apache Tomcat Multiple Vulnerabilities
Last Update Date:
7 Dec 2012
Release Date:
6 Dec 2012
5557
Views
RISK: Medium Risk
TYPE: Servers - Web Servers
Some vulnerabilities have been identified in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).
- An error within the NIO connector when transferring files using sendfile over HTTPS can be exploited to trigger an infinite loop and cause excessive consumption of CPU resources.
- An error within the FormAuthenticator component when handling authentication requests can be exploited to bypass the authentication mechanism via a specially crafted request.
- An error within the "doFilter()" method when accessing protected resources can be exploited to bypass the CSRF prevention filter and access the resource without a session identifier.
Impact
- Denial of Service
- Security Restriction Bypass
System / Technologies affected
- Apache Tomcat 6.x
- Apache Tomcat 7.x
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Update to a fixed version.
Vulnerability Identifier
Source
Related Link
Share with