Bug 675347

Summary:	tomcat: remote DoS via wrong logic in JVM
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dknox, dwalluck, pcheung, sochotni, SpikeFedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-02-07 16:54:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2011-02-05 00:27:59 UTC

Apache Tomcat 6.0.32 was released [1] to fix, among other things, a logic error in JVM that could cause Double conversion to hang JVM when accessing a form-based security constrained page.  It is reported that this behaviour can be used for a denial of service using a carefully crafted request.

The upstream report indicates that 6.0.0-6.0.31 is affected by this issue.  No further information is available.

[1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.32

Comment 1 Vincent Danen 2011-02-07 16:54:10 UTC

Upstream indicates this is not a bug in tomcat, but in JVM (http://tomcat.apache.org/security-6.html#Not_a_vulnerability_in_Tomcat):

"A JVM bug could cause Double conversion to hang JVM when accessing to a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales(). A specially crafted request can be used to trigger a denial of service. "

Upstream does have a workaround for this issue:

http://svn.apache.org/viewvc?view=revision&revision=1066315

The real issue is in Java, which is already tracked in bug #674336.

*** This bug has been marked as a duplicate of bug 674336 ***