java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote
    attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to
    trigger a hang in request processing. (CVE-2014-0095)

The version of Tomcat installed on the remote host is prior to 8.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.0.5_security-8 advisory.

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption)     via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
    (CVE-2014-0075)

  - java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote     attackers to cause a denial of service (thread consumption) by using a Content-Length: 0 AJP request to     trigger a hang in request processing. (CVE-2014-0095)

  - java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before     6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows     remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web     application that provides an XML external entity declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue. (CVE-2014-0096)

  - Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct     HTTP request smuggling attacks via a crafted Content-Length HTTP header. (CVE-2014-0099)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
432839	SCA: security update for org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote (GHSA-wf5v-jhxj-q632)	Tenable Cloud Security	SCA Checks	Local	medium
432839	SCA: security update for org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote (GHSA-wf5v-jhxj-q632)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
74248	Apache Tomcat 8.0.0-RC1 < 8.0.5 multiple vulnerabilities	Nessus	Web Servers	Combined	medium

Detections

Analytics

CVE-2014-0095

medium

Tenable Plugins

medium

medium

medium