Bug 873695 (CVE-2012-2733) - CVE-2012-2733 tomcat: HTTP NIO connector OOM DoS via a request with large headers
Summary: CVE-2012-2733 tomcat: HTTP NIO connector OOM DoS via a request with large hea...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-2733
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 873703 873707 881602 881603 881605
Blocks: 873710
TreeView+ depends on / blocked
 
Reported: 2012-11-06 14:03 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:57 UTC (History)
12 users (show)

Fixed In Version: Apache Tomcat 6.0.36, Apache Tomcat 7.0.28
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-07-01 00:44:49 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0265 0 normal SHIPPED_LIVE Moderate: tomcat6 security update 2013-02-20 01:29:31 UTC
Red Hat Product Errata RHSA-2013:0266 0 normal SHIPPED_LIVE Moderate: tomcat6 security update 2013-02-20 03:12:56 UTC

Description Jan Lieskovsky 2012-11-06 14:03:22 UTC 
A denial of service flaw was found in the way Tomcat's HTTP NIO connector enforced limits on the permitted size of request headers. A remote attacker could use this flaw to trigger an OutOfMemoryError by sending a specially-crafted request with very large headers.

This flaw affects all versions of Tomcat up to 6.0.35 [1] and 7.0.27 [2].

[1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
[2] http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.28

Relevant upstream patches are:
Tomcat 6: http://svn.apache.org/viewvc?view=rev&rev=1356208
Tomcat 7: http://svn.apache.org/viewvc?view=rev&rev=1350301
Comment 1 Jan Lieskovsky 2012-11-06 14:05:47 UTC 
This issue affects the version of the tomcat6 package as shipped with JBoss Enterprise Web Server 1.0.2.

--

This issue affects the versions of the tomcat6 package, as shipped with Fedora release of 16 and 17.
Comment 3 Jan Lieskovsky 2012-11-06 14:10:51 UTC 
Relevant upstream patch for Tomcat 7:
[3] http://svn.apache.org/viewvc?view=rev&rev=1350301

Affected Tomcat 7 versions: From 7.0.0 up to 7.0.27.
Comment 4 Jan Lieskovsky 2012-11-06 14:14:37 UTC 
This issue affects the version of the tomcat package, as shipped with Fedora release of 16.

--

This issue did not affect the version of the tomcat package, as shipped with Fedora release of 17 (that version was already updated).
Comment 5 Jan Lieskovsky 2012-11-06 14:17:22 UTC 
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 873703]
Comment 6 Jan Lieskovsky 2012-11-06 14:22:48 UTC 
Created tomcat tracking bugs for this issue

Affects: fedora-16 [bug 873707]
Comment 7 Arun Babu Neelicattu 2012-11-29 08:12:21 UTC 
This flaw does not affect jbossweb as the NIO connector is not present.
Comment 9 Fedora Update System 2012-12-19 08:29:13 UTC 
tomcat-7.0.33-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2013-02-19 20:30:51 UTC 
This issue has been addressed in following products:

  JBoss Enterprise Web Server 2.0.0

Via RHSA-2013:0265 https://rhn.redhat.com/errata/RHSA-2013-0265.html
Comment 14 errata-xmlrpc 2013-02-19 22:14:55 UTC 
This issue has been addressed in following products:

  JBEWS 2 for RHEL 5
  JBEWS 2 for RHEL 6

Via RHSA-2013:0266 https://rhn.redhat.com/errata/RHSA-2013-0266.html
Note You need to log in before you can comment on or make changes to this bug.