Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

This tomcat6 update fixes :

  - CVE-2010-3718: CVSS v2 Base Score: 4.0     (AV:N/AC:H/Au:N/C:P/I:P/A:N): Design Error     (CWE-DesignError)

  - CVE-2011-0013: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): XSS (CWE-79)

  - CVE-2011-0534: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

From Red Hat Security Advisory 2011:0335 :

Updated tomcat6 packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request.
(CVE-2010-4476)

A flaw was found in the Tomcat NIO (Non-Blocking I/O) connector. A remote attacker could use this flaw to cause a denial of service (out-of-memory condition) via a specially crafted request containing a large NIO buffer size request value. (CVE-2011-0534)

This update also fixes the following bug :

* A bug in the 'tomcat6' init script prevented additional Tomcat instances from starting. As well, running 'service tomcat6 start' caused configuration options applied from '/etc/sysconfig/tomcat6' to be overwritten with those from '/etc/tomcat6/tomcat6.conf'. With this update, multiple instances of Tomcat run as expected. (BZ#676922)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request.
(CVE-2010-4476)

A flaw was found in the Tomcat NIO (Non-Blocking I/O) connector. A remote attacker could use this flaw to cause a denial of service (out-of-memory condition) via a specially crafted request containing a large NIO buffer size request value. (CVE-2011-0534)

This update also fixes the following bug :

  - A bug in the 'tomcat6' init script prevented additional     Tomcat instances from starting. As well, running     'service tomcat6 start' caused configuration options     applied from '/etc/sysconfig/tomcat6' to be overwritten     with those from '/etc/tomcat6/tomcat6.conf'. With this     update, multiple instances of Tomcat run as expected.
    (BZ#676922)

Tomcat must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

Fixes for: CVE-2011-3190 - authentication bypass and information disclosure CVE-2011-2526 - send file validation CVE-2011-2204 - password disclosure vulnerability JAVA_HOME setting in tomcat6.conf

CVE-2011-0534, CVE-2011-0013, CVE-2010-3718

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory.
(CVE-2010-3718)

It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain.
(CVE-2011-0013)

It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service. (CVE-2011-0534).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Apache Tomcat Local bypass of security manger file     permissions. (CVE-2010-3718)

  - Apache Tomcat Manager XSS vulnerability. (CVE-2011-0013)

Updated tomcat6 packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request.
(CVE-2010-4476)

A flaw was found in the Tomcat NIO (Non-Blocking I/O) connector. A remote attacker could use this flaw to cause a denial of service (out-of-memory condition) via a specially crafted request containing a large NIO buffer size request value. (CVE-2011-0534)

This update also fixes the following bug :

* A bug in the 'tomcat6' init script prevented additional Tomcat instances from starting. As well, running 'service tomcat6 start' caused configuration options applied from '/etc/sysconfig/tomcat6' to be overwritten with those from '/etc/tomcat6/tomcat6.conf'. With this update, multiple instances of Tomcat run as expected. (BZ#676922)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

This tomcat6 update fixes :

  - CVE-2010-3718: CVSS v2 Base Score: 4.0     (AV:N/AC:H/Au:N/C:P/I:P/A:N): Design Error     (CWE-DesignError)

  - CVE-2011-0013: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): XSS (CWE-79)

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 6.0.32 or 7.0.8. It is, therefore, affected by a denial of service vulnerability. An error, involving the NIO HTTP connector, exists such that the limit 'maxHttpHeaderSize' is not enforced thereby allowing a denial of service condition when memory is exhausted.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine :

  - CVE-2010-3718     It was discovered that the SecurityManager     insufficiently restricted the working directory.

  - CVE-2011-0013     It was discovered that the HTML manager interface is     affected by cross-site scripting.

  - CVE-2011-0534     It was discovered that NIO connector performs     insufficient validation of the HTTP headers, which could     lead to denial of service.

The oldstable distribution (lenny) is not affected by these issues.

Versions of Tomcat 7.0.x earlier than 7.0.8 are potentially affected by a denial of service vulnerability becasue the NIO connector expands its buffer endlessly during request line processing.

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 7.0.8. It is, therefore, affected by a denial of service vulnerability. An error, involving the NIO HTTP connector, exists such that the limit 'maxHttpHeaderSize' is not enforced thereby allowing a denial of service condition when memory is exhausted.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of Tomcat 6.x earlier than 6.0.32 are potentially affected by a denial of service vulnerability because the NIO connector expands its buffer endlessly during request line processing.

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 6.0.32. It is, therefore, affected by a denial of service vulnerability. An error, involving the NIO HTTP connector, exists such that the limit 'maxHttpHeaderSize' is not enforced thereby allowing a denial of service condition when memory is exhausted.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
75761	openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0146-1)	Nessus	SuSE Local Security Checks	medium
68224	Oracle Linux 6 : tomcat6 (ELSA-2011-0335)	Nessus	Oracle Linux Local Security Checks	medium
60985	Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
56573	Fedora 14 : tomcat6-6.0.26-27.fc14 (2011-13457)	Nessus	Fedora Local Security Checks	high
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	critical
53807	openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0146-1)	Nessus	SuSE Local Security Checks	medium
53221	Ubuntu 9.10 / 10.04 LTS / 10.10 : tomcat6 vulnerabilities (USN-1097-1)	Nessus	Ubuntu Local Security Checks	medium
52711	SuSE9 Security Update : Tomcat (YOU Patch Number 12687)	Nessus	SuSE Local Security Checks	medium
52606	RHEL 6 : tomcat6 (RHSA-2011:0335)	Nessus	Red Hat Local Security Checks	medium
52525	SuSE 10 Security Update : Tomcat (ZYPP Patch Number 7337)	Nessus	SuSE Local Security Checks	medium
51987	Apache Tomcat < 6.0.32 / 7.0.8 NIO Connector DoS	Nessus	Web Servers	medium
51959	Debian DSA-2160-1 : tomcat6 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
800621	Apache Tomcat 7.0.x < 7.0.8 Denial of Service Vulnerability	Log Correlation Engine	Web Servers	medium
5795	Apache Tomcat 7.0.x < 7.0.8 NIO Connector DoS	Nessus Network Monitor	Web Servers	medium
800599	Apache Tomcat 6.0.x < 6.0.32 Denial of Service Vulnerability	Log Correlation Engine	Web Servers	medium
5790	Apache Tomcat 6.0.x < 6.0.32 NIO Connector DoS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2011-0534

medium

Tenable Plugins

medium

medium

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium