CVE-2016-3092

HIGH

Description

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

References

http://jvn.jp/en/jp/JVN89379547/index.html

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121

http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html

http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E

http://rhn.redhat.com/errata/RHSA-2016-2068.html

http://rhn.redhat.com/errata/RHSA-2016-2069.html

http://rhn.redhat.com/errata/RHSA-2016-2070.html

http://rhn.redhat.com/errata/RHSA-2016-2071.html

http://rhn.redhat.com/errata/RHSA-2016-2072.html

http://rhn.redhat.com/errata/RHSA-2016-2599.html

http://rhn.redhat.com/errata/RHSA-2016-2807.html

http://rhn.redhat.com/errata/RHSA-2016-2808.html

http://rhn.redhat.com/errata/RHSA-2017-0457.html

http://svn.apache.org/viewvc?view=revision&revision=1743480

http://svn.apache.org/viewvc?view=revision&revision=1743722

http://svn.apache.org/viewvc?view=revision&revision=1743738

http://svn.apache.org/viewvc?view=revision&revision=1743742

http://tomcat.apache.org/security-7.html

http://tomcat.apache.org/security-8.html

http://tomcat.apache.org/security-9.html

http://www.debian.org/security/2016/dsa-3609

http://www.debian.org/security/2016/dsa-3611

http://www.debian.org/security/2016/dsa-3614

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://www.securityfocus.com/bid/91453

http://www.securitytracker.com/id/1036427

http://www.securitytracker.com/id/1036900

http://www.securitytracker.com/id/1037029

http://www.securitytracker.com/id/1039606

http://www.ubuntu.com/usn/USN-3024-1

http://www.ubuntu.com/usn/USN-3027-1

https://access.redhat.com/errata/RHSA-2017:0455

https://access.redhat.com/errata/RHSA-2017:0456

https://bugzilla.redhat.com/show_bug.cgi?id=1349468

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://security.gentoo.org/glsa/201705-09

https://security.netapp.com/advisory/ntap-20190212-0001/

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Details

Source: MITRE

Published: 2016-07-04

Updated: 2019-04-23

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 7.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:hp:icewall_identity_manager:5.0:*:*:*:*:*:*:*

cpe:2.3:a:hp:icewall_sso_agent_option:10.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 5

OR

cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*

Configuration 6

OR

cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* versions up to 1.3.1 (inclusive)

Configuration 7

OR

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Configuration 8

OR

cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*

Tenable Plugins

View all (38 total)

IDNameProductFamilySeverity
126467Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jul 2017 CPU)NessusMisc.
medium
121119Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.0.x < 9.0.0.M8 Denial of ServiceNessusWeb Servers
high
112248RHEL 7 : JBoss EAP (RHSA-2016:2069)NessusRed Hat Local Security Checks
high
112192Apache ActiveMQ 5.x < 5.15.5 Multiple VulnerabilitiesNessusCGI abuses
high
109209Oracle WebCenter Sites Remote Vulnerability (April 2018 CPU)NessusWindows
medium
103962Oracle GlassFish Server 3.0.1.x < 3.0.1.17 / 3.1.2.x < 3.1.2.18 (October 2017 CPU)NessusWeb Servers
high
101837Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)NessusMisc.
high
100262GLSA-201705-09 : Apache Tomcat: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
99816EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1054)NessusHuawei Local Security Checks
high
99594Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (April 2017 CPU) (SWEET32)NessusMisc.
critical
99593MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)NessusCGI abuses
critical
97596RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)NessusRed Hat Local Security Checks
high
97595RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)NessusRed Hat Local Security Checks
high
9941Atlassian Bitbucket Server 4.x < 4.8.2 Directory TraversalNessus Network MonitorCGI
high
9905Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.x < 9.0.0.M8 Denial of Service (deprecated)Nessus Network MonitorWeb Servers
high
9904Apache TomEE 7.x < 7.0.1 DoSNessus Network MonitorWeb Servers
high
700700Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.x < 9.0.0.M8 Denial of ServiceNessus Network MonitorWeb Servers
high
95882IBM Domino 8.5.x < 8.5.3 Fix Pack 6 Interim Fix 15 / 9.0.x < 9.0.1 Fix Pack 7 Interim Fix 1 Multiple VulnerabilitiesNessusMisc.
medium
95863Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)NessusScientific Linux Local Security Checks
high
95345CentOS 7 : tomcat (CESA-2016:2599)NessusCentOS Local Security Checks
high
95024RHEL 6 / 7 : JBoss Web Server (RHSA-2016:2807)NessusRed Hat Local Security Checks
high
94880Fedora 25 : 1:tomcat (2016-f4a443888b)NessusFedora Local Security Checks
high
94718Oracle Linux 7 : tomcat (ELSA-2016-2599)NessusOracle Linux Local Security Checks
high
94562RHEL 7 : tomcat (RHSA-2016:2599)NessusRed Hat Local Security Checks
high
94104RHEL 6 : jboss-ec2-eap (RHSA-2016:2072)NessusRed Hat Local Security Checks
high
93362openSUSE Security Update : tomcat (openSUSE-2016-1056) (httpoxy)NessusSuSE Local Security Checks
high
93260Fedora 24 : 1:tomcat (2016-2b0c16fd82)NessusFedora Local Security Checks
high
93259Fedora 23 : 1:tomcat (2016-0a4dccdd23)NessusFedora Local Security Checks
high
93014Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2016-736)NessusAmazon Linux Local Security Checks
high
92342FreeBSD : Apache Commons FileUpload -- denial of service (61b8c359-4aab-11e6-a7bd-14dae9d210b8)NessusFreeBSD Local Security Checks
high
91968Ubuntu 16.04 LTS : tomcat8 vulnerability (USN-3027-1)NessusUbuntu Local Security Checks
high
91954Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : tomcat6, tomcat7 vulnerabilities (USN-3024-1)NessusUbuntu Local Security Checks
high
91925Debian DSA-3614-1 : tomcat7 - security updateNessusDebian Local Security Checks
high
91907Debian DSA-3611-1 : libcommons-fileupload-java - security updateNessusDebian Local Security Checks
high
91906Debian DSA-3609-1 : tomcat8 - security updateNessusDebian Local Security Checks
high
91841FreeBSD : Apache Commons FileUpload -- denial of service (DoS) vulnerability (cbceeb49-3bc7-11e6-8e82-002590263bf5)NessusFreeBSD Local Security Checks
high
91835Debian DLA-529-1 : tomcat7 security updateNessusDebian Local Security Checks
high
91834Debian DLA-528-1 : libcommons-fileupload-java security updateNessusDebian Local Security Checks
high