bugtraq - [SECURITY] CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <530C7C40.2060102@apache.org>
Date: Tue, 25 Feb 2014 11:19:28 +0000
From: Mark Thomas <markt@...che.org>
To: Tomcat Users List <users@...cat.apache.org>
CC: Tomcat Developers List <dev@...cat.apache.org>, announce@...che.org,
  announce@...cat.apache.org, bugtraq@...urityfocus.com,
  full-disclosure@...ts.grok.org.uk
Subject: [SECURITY] CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information
 disclosure)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure)

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- - Apache Tomcat 8.0.0-RC1
- - Apache Tomcat 7.0.0 to 7.0.42
- - Apache Tomcat 6.0.0 to 6.0.37

Description:
The fix for CVE-2005-2090 was not complete. It did not cover the
following cases:
- - content-length header with chunked encoding over any HTTP connector
- - multiple content-length headers over any AJP connector

Requests with multiple content-length headers or with a content-length
header when chunked encoding is being used should be rejected as
invalid. When multiple components (firewalls, caches, proxies and
Tomcat) process a sequence of requests where one or more requests
contain either multiple content-length headers or a content-length
header when chunked encoding is being used and several components do not
reject the request and make different decisions as to which
content-length header to use an attacker can poison a web-cache, perform
an XSS attack and obtain sensitive information from requests other then
their own. Tomcat now rejects requests with multiple content-length
headers or with a content-length header when chunked encoding is being
used.

Mitigation:
Users of affected versions should apply one of the following mitigations
- - Upgrade to Apache Tomcat 8.0.0-RC3 or later
  (8.0.0-RC2 contains the fix but was not released)
- - Upgrade to Apache Tomcat 7.0.47 or later
   (7.0.43 to 7.0.46 contain the fix but were not released)
- - Upgrade to Apache Tomcat 6.0.39 or later
   (6.0.38 contains the fix but was not released)

Credit:
This issue was identified by the Apache Tomcat security team while
investigating an invalid report related to CVE-2005-2090.

References:
[1] http://tomcat.apache.org/security-8.html
[2] http://tomcat.apache.org/security-7.html
[3] http://tomcat.apache.org/security-6.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTDHw/AAoJEBDAHFovYFnn8HgP/107ixjTiS7es6ka2fXl01Ag
A2GUdevvgKXrbgtY6nVS1Sx65GZcG1k5Knpn6Cwg31dtipnEJmuk4+ScVlA43Jjy
8UpQbI0zm0oCgIRV6lRuYGn1kz5p7cSEF+s36QOAMym3qKNJ3YZn+pALVLgmF+D8
k7Yqe3Fwih68sJm3GRStZ9zlt5s7NNfHzSfnIe4wSyleA8xyK98Xa/8tlr3p0usK
J7V5Dz1VSmi8TRpzXUVl8cWjQrD+tCZOWrrBgkWs2oj/TXiVZfiAA5Cv7p1F7HoJ
ElF7dny5PJIFdAK3TU5WAkXRQJk2yp0FNv0YRSJGx4OLsiv+IrIXpVR4K12Hmc0n
T4RzqyhfB7VGtxrLC/PpC6hoqd+LkuT6uJJA8lcfc+F51UWSHtOV5iW0h2kC6olu
s/SKsljDOzx5L2nMdFGqs49cV4uIC8CFC8yP84EJO1gyRqyABxw3LwzUZvdMJ1Sl
29QM3vpMc3EypKXEZWe28Wbr7cZLK2oJt7pSF1DoPF/8DStYYhqztooKCyXAhjum
6Juf3C+w3HvaoR2YyIu5ZhbcGqkt0GHL+ZfvyPVcIFv+TeSYejmus0zdvQGWmnep
Fgsdlbz2dUg7ncvmj7LYwCv4U6yj2oYUgMaVrocNVB8bSg0qMnfByg0tc4h8XzDv
kNN3kqRWjmDaE37ZHywC
=YF3X
-----END PGP SIGNATURE-----