Bug 675347 - tomcat: remote DoS via wrong logic in JVM
Summary: tomcat: remote DoS via wrong logic in JVM
Keywords:
Status: CLOSED DUPLICATE of bug 674336
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-05 00:27 UTC by Vincent Danen
Modified: 2019-09-29 12:42 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-02-07 16:54:10 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2011-02-05 00:27:59 UTC
Apache Tomcat 6.0.32 was released [1] to fix, among other things, a logic error in JVM that could cause Double conversion to hang JVM when accessing a form-based security constrained page.  It is reported that this behaviour can be used for a denial of service using a carefully crafted request.

The upstream report indicates that 6.0.0-6.0.31 is affected by this issue.  No further information is available.

[1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.32

Comment 1 Vincent Danen 2011-02-07 16:54:10 UTC
Upstream indicates this is not a bug in tomcat, but in JVM (http://tomcat.apache.org/security-6.html#Not_a_vulnerability_in_Tomcat):

"A JVM bug could cause Double conversion to hang JVM when accessing to a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales(). A specially crafted request can be used to trigger a denial of service. "

Upstream does have a workaround for this issue:

http://svn.apache.org/viewvc?view=revision&revision=1066315

The real issue is in Java, which is already tracked in bug #674336.

*** This bug has been marked as a duplicate of bug 674336 ***


Note You need to log in before you can comment on or make changes to this bug.