Published: 01/06/2013 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Apache Tomcat 6.x prior to 6.0.37 and 7.x prior to 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote malicious users to cause a denial of service by streaming data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 6.0.33
apache tomcat 6.0.0
apache tomcat 6.0.6
apache tomcat 6.0.4
apache tomcat 6.0.11
apache tomcat 6.0.7
apache tomcat 6.0.15
apache tomcat 6.0.20
apache tomcat 6.0.9
apache tomcat 6.0.10
apache tomcat 6.0.31
apache tomcat 6.0.29
apache tomcat 6.0.3
apache tomcat 6.0.1
apache tomcat 6.0.24
apache tomcat 6.0.17
apache tomcat 6.0
apache tomcat 6.0.32
apache tomcat 6.0.28
apache tomcat 6.0.14
apache tomcat 6.0.12
apache tomcat 6.0.18
apache tomcat 6.0.2
apache tomcat 6.0.5
apache tomcat 6.0.30
apache tomcat 6.0.13
apache tomcat 6.0.8
apache tomcat 6.0.26
apache tomcat 6.0.19
apache tomcat 6.0.27
apache tomcat 6.0.35
apache tomcat 6.0.16
apache tomcat 6.0.36
apache tomcat 7.0.2
apache tomcat 7.0.12
apache tomcat 7.0.20
apache tomcat 7.0.8
apache tomcat 7.0.1
apache tomcat 7.0.5
apache tomcat 7.0.4
apache tomcat 7.0.22
apache tomcat 7.0.28
apache tomcat 7.0.0
apache tomcat 7.0.6
apache tomcat 7.0.18
apache tomcat 7.0.14
apache tomcat 7.0.11
apache tomcat 7.0.23
apache tomcat 7.0.7
apache tomcat 7.0.13
apache tomcat 7.0.15
apache tomcat 7.0.19
apache tomcat 7.0.16
apache tomcat 7.0.10
apache tomcat 7.0.25
apache tomcat 7.0.21
apache tomcat 7.0.17
apache tomcat 7.0.9
apache tomcat 7.0.3

Several security issues were fixed in Tomcat ...

Debian Bug report logs - #707704 tomcat7: CVE-2013-2071 Package: tomcat7; Maintainer for tomcat7 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for tomcat7 is src:tomcat7 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Fri, 10 May 2013 13:27:01 UTC Seve ...

It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request A remote attacker could use this flaw to poison a web cache, perform cross-site scripting ...

Apache Tomcat 6x before 6037 and 7x before 7030 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data ...

CWE-20 http://tomcat.apache.org/security-7.html http://tomcat.apache.org/security-6.html http://svn.apache.org/viewvc?view=revision&revision=1476592 http://svn.apache.org/viewvc?view=revision&revision=1378921 http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592&r2=1476591&pathrev=1476592 http://svn.apache.org/viewvc?view=revision&revision=1378702 http://www.ubuntu.com/usn/USN-1841-1 http://archives.neohapsis.com/archives/bugtraq/2013-05/0042.html http://www.securityfocus.com/bid/64758 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.securityfocus.com/bid/59797 http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.securityfocus.com/archive/1/534161/100/0/threaded https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E https://usn.ubuntu.com/1841-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2012-3544

CVE-2012-3544

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect