bugtraq - Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <53848E5B.8050306@apache.org>
Date: Tue, 27 May 2014 14:08:43 +0100
From: Mark Thomas <markt@...che.org>
To: Tomcat Users List <users@...cat.apache.org>
CC: Tomcat Developers List <dev@...cat.apache.org>, announce@...che.org,
  announce@...cat.apache.org, fulldisclosure@...lists.org,
  bugtraq@...urityfocus.com
Subject: Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure

CORRECTION: This is CVE-2014-0099 *NOT* -0097
            Apologies for the typo

On 27/05/2014 13:46, Mark Thomas wrote:
> CVE-2014-0099 Information Disclosure
> 
> Severity: Important
> 
> Vendor: The Apache Software Foundation
> 
> Versions Affected:
> - Apache Tomcat 8.0.0-RC1 to 8.0.3
> - Apache Tomcat 7.0.0 to 7.0.52
> - Apache Tomcat 6.0.0 to 6.0.39
> 
> Description:
> The code used to parse the request content length header did not check
> for overflow in the result. This exposed a request smuggling
> vulnerability when Tomcat was located behind a reverse proxy that
> correctly processed the content length header.
> 
> Mitigation:
> Users of affected versions should apply one of the following mitigations
> - Upgrade to Apache Tomcat 8.0.5 or later
>   (8.0.4 contains the fix but was not released)
> - Upgrade to Apache Tomcat 7.0.53 or later
> - Upgrade to Apache Tomcat 6.0.41 or later
>   (6.0.40 contains the fix but was not released)
> 
> Credit:
> A test case that demonstrated the parsing bug was sent to the Tomcat
> security team but no context was provided. The security implications
> were identified by the Tomcat security team .
> 
> References:
> [1] http://tomcat.apache.org/security-8.html
> [2] http://tomcat.apache.org/security-7.html
> [3] http://tomcat.apache.org/security-6.html
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: security-unsubscribe@...cat.apache.org
> For additional commands, e-mail: security-help@...cat.apache.org
>