Apache Tomcat NIO Connector Denial of Service Vulnerability
BID:46164
Info
Apache Tomcat NIO Connector Denial of Service Vulnerability
| Bugtraq ID: | 46164 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2011-0534 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 03 2011 12:00AM |
| Updated: | May 07 2015 05:12PM |
| Credit: | Yuesong Wang |
| Vulnerable: |
Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 11 Express Sun Solaris 10_x86 Sun Solaris 10_sparc Red Hat JBoss Enterprise Web Server for RHEL 5 Server 1.0 Red Hat JBoss Enterprise Web Server for RHEL 4 ES 1.0 Red Hat JBoss Enterprise Web Server for RHEL 4 AS 1.0 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Novell Vibe OnPrem 3.0 Novell Teaming 2.1 Novell Teaming 1.0 SP3 Novell Teaming 1.0 SP2 Novell Teaming 1.0 SP1 IBM WebSphere Application Server Community Edition 2.1.1.5 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya Interactive Response 4.0 Avaya Interactive Response 3.0 Avaya Conferencing Standard Edition 6.0 SP1 Avaya Conferencing Standard Edition 6.0 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 6.1 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac Os X Server 10.6.8 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6 Apache Software Foundation Tomcat 7.0.6 Apache Software Foundation Tomcat 7.0.4 Apache Software Foundation Tomcat 7.0.3 Apache Software Foundation Tomcat 7.0.2 Apache Software Foundation Tomcat 7.0.1 Apache Software Foundation Tomcat 7.0 beta Apache Software Foundation Tomcat 7.0 Apache Software Foundation Tomcat 6.0.29 Apache Software Foundation Tomcat 6.0.28 Apache Software Foundation Tomcat 6.0.27 Apache Software Foundation Tomcat 6.0.26 Apache Software Foundation Tomcat 6.0.25 Apache Software Foundation Tomcat 6.0.24 Apache Software Foundation Tomcat 6.0.20 Apache Software Foundation Tomcat 6.0.18 Apache Software Foundation Tomcat 6.0.17 Apache Software Foundation Tomcat 6.0.16 Apache Software Foundation Tomcat 6.0.15 Apache Software Foundation Tomcat 6.0.14 Apache Software Foundation Tomcat 6.0.13 Apache Software Foundation Tomcat 6.0.12 Apache Software Foundation Tomcat 6.0.11 Apache Software Foundation Tomcat 6.0.10 Apache Software Foundation Tomcat 6.0.9 Apache Software Foundation Tomcat 6.0.8 Apache Software Foundation Tomcat 6.0.7 Apache Software Foundation Tomcat 6.0.6 Apache Software Foundation Tomcat 6.0.5 Apache Software Foundation Tomcat 6.0.4 Apache Software Foundation Tomcat 6.0.3 Apache Software Foundation Tomcat 6.0.2 Apache Software Foundation Tomcat 6.0.1 Apache Software Foundation Tomcat 6.0 Apache Software Foundation Tomcat 7.0.5 Apache Software Foundation Tomcat 7.0 Apache Software Foundation Tomcat 6.0.31 Apache Software Foundation Tomcat 6.0.30 Apache Software Foundation Tomcat 6.0.29 Apache Software Foundation Tomcat 6.0.19 Apache Software Foundation Geronimo 2.1.7 Apache Software Foundation Geronimo 2.1.6 Apache Software Foundation Geronimo 2.1.5 Apache Software Foundation Geronimo 2.1.4 Apache Software Foundation Geronimo 2.1.3 Apache Software Foundation Geronimo 2.1.2 Apache Software Foundation Geronimo 2.1.1 Apache Software Foundation Geronimo 2.0.2 Apache Software Foundation Geronimo 2.0.1 Apache Software Foundation Geronimo 1.1.1 Apache Software Foundation Geronimo 1.1 Apache Software Foundation Geronimo 1.0.1 Apache Software Foundation Geronimo 1.0 Apache Software Foundation Geronimo 2.1 Apache Software Foundation Geronimo 2.0 Apache Software Foundation Geronimo 1.2 Apache Software Foundation Geronimo 1.1 Apache Software Foundation Geronimo 1.0 |
| Not Vulnerable: |
Novell Vibe OnPrem 3.1 Apache Software Foundation Tomcat 7.0.8 Apache Software Foundation Tomcat 6.0.32 Apache Software Foundation Geronimo 2.1.8 |
Discussion
Apache Tomcat NIO Connector Denial of Service Vulnerability
Apache Tomcat is prone to a denial-of-service vulnerability.
An attacker may leverage this issue to trigger a denial-of-service condition in the affected software.
The issue affect Apache Tomcat versions prior to 6.0.32 and 7.0.8 are vulnerable; other versions may also be affected.
Apache Tomcat is prone to a denial-of-service vulnerability.
An attacker may leverage this issue to trigger a denial-of-service condition in the affected software.
The issue affect Apache Tomcat versions prior to 6.0.32 and 7.0.8 are vulnerable; other versions may also be affected.
Exploit / POC
Apache Tomcat NIO Connector Denial of Service Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apache Tomcat NIO Connector Denial of Service Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
Ubuntu Ubuntu Linux 9.10 lpia
Apple Mac OS X 10.6.8
Ubuntu Ubuntu Linux 10.04 powerpc
Ubuntu Ubuntu Linux 9.10 ARM
Ubuntu Ubuntu Linux 9.10 amd64
Ubuntu Ubuntu Linux 10.10 powerpc
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
-
Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb
Ubuntu Ubuntu Linux 9.10 lpia
-
Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb
Apple Mac OS X 10.6.8
-
Apple SecUpd2011-006Snow.dmg
http://www.apple.com/support/downloads/
Ubuntu Ubuntu Linux 10.04 powerpc
-
Ubuntu libservlet2.5-java-doc_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.24-2ubuntu1.7_all.deb -
Ubuntu libservlet2.5-java_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.24-2ubuntu1.7_all.deb -
Ubuntu libtomcat6-java_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.24-2ubuntu1.7_all.deb -
Ubuntu tomcat6-admin_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.24-2ubuntu1.7_all.deb -
Ubuntu tomcat6-common_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.24-2ubuntu1.7_all.deb -
Ubuntu tomcat6-docs_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .24-2ubuntu1.7_all.deb -
Ubuntu tomcat6-examples_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.24-2ubuntu1.7_all.deb -
Ubuntu tomcat6-user_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .24-2ubuntu1.7_all.deb -
Ubuntu tomcat6_6.0.24-2ubuntu1.7_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.24-2 ubuntu1.7_all.deb
Ubuntu Ubuntu Linux 9.10 ARM
-
Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb
Ubuntu Ubuntu Linux 9.10 amd64
-
Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb -
Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb -
Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb -
Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb
Ubuntu Ubuntu Linux 10.10 powerpc
-
Ubuntu libservlet2.5-java-doc_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.28-2ubuntu1.2_all.deb -
Ubuntu libservlet2.5-java_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.28-2ubuntu1.2_all.deb -
Ubuntu libtomcat6-java_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.28-2ubuntu1.2_all.deb -
Ubuntu tomcat6-admin_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.28-2ubuntu1.2_all.deb -
Ubuntu tomcat6-common_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.28-2ubuntu1.2_all.deb -
Ubuntu tomcat6-docs_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .28-2ubuntu1.2_all.deb -
Ubuntu tomcat6-examples_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.28-2ubuntu1.2_all.deb -
Ubuntu tomcat6-user_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .28-2ubuntu1.2_all.deb -
Ubuntu tomcat6_6.0.28-2ubuntu1.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.28-2 ubuntu1.2_all.deb
References
Apache Tomcat NIO Connector Denial of Service Vulnerability
References:
References:
- Apache Tomcat 7.x vulnerabilities (Apache Software Foundation)
- Apache Tomcat Homepage (Apache)
- Fixed in Geronimo 2.1.8 (Apache Geronimo)
- Multiple vulnerabilities in Apache Tomcat (Oracle)
- Novell Vibe OnPrem (Novell)
- Teaming Homepage (Novell)
- Tomcat fix for security vulnerability CVE-2010-3718 , CVE-2011-2526 and CVE-2011 (IBM)
- ASA-2011-155: Apache Tomcat DoS vulnerability (CVE-2011-0534) (Avaya)
- ASA-2011-357 Multiple vulnerabilities in Apache Tomcat (Oracle November 2011) (Avaya)
- Bug 50631 - InternalNioInputBuffer should honor maxHttpHeadSize (ASF Bugzilla)