Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022) 

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

The version of VMware vCenter Server installed on the remote host is 4.0 before Update 4a, 4.1 before Update 3, or 5.0 before Update 1.  As such it is potentially affected by multiple vulnerabilities in the embedded Apache Tomcat server and the Oracle (Sun) Java Runtime Environment.

This update of tomcat6 fixes :

  - apache-tomcat-CVE-2012-3544.patch. (bnc#831119)

  - use chown --no-dereference to prevent symlink attacks on     log (bnc#822177#c7/prevents CVE-2013-1976)

  - Fix tomcat init scripts generating malformed classpath (     http://youtrack.jetbrains.com/issue/JT-18545 )     bnc#804992 (patch from m407)

  - fix a typo in initscript. (bnc#768772)

  - copy all shell scripts (bnc#818948)

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially affected by the following vulnerabilities related to the included Apache Tomcat version :

  - An error exists related to handling requests containing     several parameters that could allow denial of service     attacks. (CVE-2012-0022)

  - An error exists related to handling partial HTTP     requests that could allow denial of service attacks.
    (CVE-2012-5568)

  - Errors exist related to handling DIGEST authentication     that could allow security mechanisms to be bypassed.
    (CVE-2012-5885, CVE-2012-5886, CVE-2012-5887)

According to its self-reported version number, the instance of Apache Tomcat 6.x listening on the remote host is prior to 6.0.35. It is, therefore, affected by multiple vulnerabilities :

  - Specially crafted requests are incorrectly processed     by Tomcat and can cause the server to allow injection     of arbitrary AJP messages. This can lead to     authentication bypass and disclosure of sensitive     information. (CVE-2011-3190)

  - An information disclosure vulnerability exists. Request     information is cached in two objects and these objects     are not recycled at the same time. Further requests can     obtain sensitive information if certain error conditions     occur. (CVE-2011-3375)

  - Large numbers of crafted form parameters can cause     excessive CPU consumption due to hash collisions.
    (CVE-2011-4858, CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in Tomcat, a servlet and JSP engine :

  - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064     The HTTP Digest Access Authentication implementation     performed insufficient countermeasures against replay     attacks.

  - CVE-2011-2204     In rare setups passwords were written into a logfile.

  - CVE-2011-2526     Missing input sanitising in the HTTP APR or HTTP NIO     connectors could lead to denial of service.

  - CVE-2011-3190     AJP requests could be spoofed in some setups.

  - CVE-2011-3375     Incorrect request caching could lead to information     disclosure.

  - CVE-2011-4858 CVE-2012-0022     This update adds countermeasures against a collision     denial of service vulnerability in the Java hashtable     implementation and addresses denial of service     potentials when processing large amounts of requests.

Additional information can be found at

It was discovered that Tomcat incorrectly performed certain caching and recycling operations. A remote attacker could use this flaw to obtain read access to IP address and HTTP header information in certain cases. This issue only applied to Ubuntu 11.10.
(CVE-2011-3375)

It was discovered that Tomcat computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by sending many crafted parameters. (CVE-2011-4858)

It was discovered that Tomcat incorrectly handled parameters. A remote attacker could cause a denial of service by sending requests with a large number of parameters and values. (CVE-2012-0022).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated tomcat5 packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

Red Hat would like to thank oCERT for reporting CVE-2011-4858. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4858.

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-510:02 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and released under the Apache Software     License. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
    We invite you to participate in this open development project. To learn more about getting involved, click     here.
    Security issues fixed with this release:
     CVE-2011-4858     Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form     parameters without restricting the ability to trigger hash collisions predictably, which allows remote     attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
     CVE-2012-0022     Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach     for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via     a request that contains many parameters and parameter values, a different vulnerability than     CVE-2011-4858.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
61299	Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64 (20120411)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
61300	Scientific Linux Security Update : tomcat6 on SL6.x (20120411)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
66812	VMware vCenter Server Multiple Vulnerabilities (VMSA-2012-0005)	Nessus	Misc.	6/5/2013	11/15/2018	high
69458	SuSE 11.2 / 11.3 Security Update : tomcat6 (SAT Patch Numbers 8155 / 8156)	Nessus	SuSE Local Security Checks	8/23/2013	1/19/2021	medium
71023	Juniper NSM Servers < 2012.2R5 Multiple Vulnerabilities	Nessus	Misc.	11/21/2013	4/11/2022	medium
57080	Apache Tomcat 6.x < 6.0.35 Multiple Vulnerabilities	Nessus	Web Servers	12/12/2011	5/6/2024	high
57812	Debian DSA-2401-1 : tomcat6 - several vulnerabilities	Nessus	Debian Local Security Checks	2/3/2012	1/11/2021	high
57933	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : tomcat6 vulnerabilities (USN-1359-1)	Nessus	Ubuntu Local Security Checks	2/14/2012	9/19/2019	medium
58685	CentOS 5 : tomcat5 (CESA-2012:0474)	Nessus	CentOS Local Security Checks	4/12/2012	1/4/2021	medium
284337	MiracleLinux 3 : tomcat5-5.5.23-0jpp.31.0.1.AXS3 (AXSA:2012-510:02)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

high

high

medium

medium

medium