Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability

Bugtraq ID:	74475
Class:	Design Error
CVE:	CVE-2014-0230
Remote:	Yes
Local:	No
Published:	May 05 2015 12:00AM
Updated:	May 23 2017 04:27PM
Credit:	AntBean () secdig from the Baidu Security Team
Vulnerable:	Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Redhat JBoss Enterprise Web Server 2 EL6 Redhat JBoss Enterprise Web Server 2 EL5 Redhat JBoss Enterprise Application Platform 6.4.6 Oracle Virtualization 5.1 Oracle Virtualization 4.71 Oracle Virtualization 4.63 IBM WebSphere Cast Iron 7.0 IBM WebSphere Cast Iron 6.1 IBM WebSphere Cast Iron 7.0.0.2 IBM WebSphere Cast Iron 7.0.0.1 IBM WebSphere Cast Iron 6.4.0.1 IBM WebSphere Cast Iron 6.4.0.0 IBM WebSphere Cast Iron 6.3.0.2 IBM WebSphere Cast Iron 6.3.0.1 IBM WebSphere Cast Iron 6.1.0.9 IBM WebSphere Cast Iron 6.1.0.8 IBM WebSphere Cast Iron 6.1.0.7 IBM WebSphere Cast Iron 6.1.0.6 IBM WebSphere Cast Iron 6.1.0.15 IBM WebSphere Cast Iron 6.1.0.12 IBM WebSphere Cast Iron 6.0.0.6 IBM WebSphere Cast Iron 6.0.0.5 IBM WebSphere Cast Iron 6.0.0.4 IBM WebSphere Cast Iron 6.0.0.3 IBM Tivoli Common Reporting 3.1.2 IBM Tivoli Common Reporting 2.1.1 IBM Tivoli Common Reporting 3.1.0.2 IBM Tivoli Common Reporting 3.1.0.1 IBM Tivoli Common Reporting 3.1 IBM Tivoli Common Reporting 2.1.1.2 IBM Tivoli Common Reporting 2.1 IBM Tivoli Application Dependency Discovery Manager 7.2.2 IBM Tivoli Application Dependency Discovery Manager 7.2.1 3 IBM Tivoli Application Dependency Discovery Manager 7.2.1 2 IBM Tivoli Application Dependency Discovery Manager 7.2.1 1 IBM Tivoli Application Dependency Discovery Manager 7.2.1 IBM Tivoli Application Dependency Discovery Manager 7.1.2 8 IBM Tivoli Application Dependency Discovery Manager 7.1.2 7 IBM Tivoli Application Dependency Discovery Manager 7.1.2 6 IBM Tivoli Application Dependency Discovery Manager 7.1.2 5 IBM Tivoli Application Dependency Discovery Manager 7.1.2 4 IBM Tivoli Application Dependency Discovery Manager 7.1.2 3 IBM Tivoli Application Dependency Discovery Manager 7.1.2 2 IBM Tivoli Application Dependency Discovery Manager 7.3.0.1 IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 IBM Tivoli Application Dependency Discovery Manager 7.2.2.3 IBM Tivoli Application Dependency Discovery Manager 7.2.2.2 IBM Tivoli Application Dependency Discovery Manager 7.2.2.1 IBM Tivoli Application Dependency Discovery Manager 7.2.1.6 IBM Tivoli Application Dependency Discovery Manager 7.2.1.5 IBM Tivoli Application Dependency Discovery Manager 7.2.1.4 IBM Tivoli Application Dependency Discovery Manager 7.2.0.9 IBM Tivoli Application Dependency Discovery Manager 7.2.0.8 IBM Tivoli Application Dependency Discovery Manager 7.2.0.7 IBM Tivoli Application Dependency Discovery Manager 7.2.0.6 IBM Tivoli Application Dependency Discovery Manager 7.2.0.5 IBM Tivoli Application Dependency Discovery Manager 7.2.0.4 IBM Tivoli Application Dependency Discovery Manager 7.2.0.3 IBM Tivoli Application Dependency Discovery Manager 7.2.0.2 IBM Tivoli Application Dependency Discovery Manager 7.2.0.10 IBM Tivoli Application Dependency Discovery Manager 7.2.0.1 IBM Tivoli Application Dependency Discovery Manager 7.2.0 IBM Tivoli Application Dependency Discovery Manager 7.2 IBM Tivoli Application Dependency Discovery Manager 7.1.2 IBM Storwize V7000 Unified 1.4.3 4 IBM Storwize V7000 Unified 1.4.3 3 IBM Storwize V7000 Unified 1.4.3 2 IBM Storwize V7000 Unified 1.4 1 IBM Storwize V7000 Unified 1.4 0 IBM Storwize V7000 Unified 1.3.2 3 IBM Storwize V7000 Unified 1.3.2 1 IBM Storwize V7000 Unified 1.3.2 0 IBM Storwize V7000 Unified 1.5.2.1 IBM Storwize V7000 Unified 1.5.2.0 IBM Storwize V7000 Unified 1.5.1.3 IBM Storwize V7000 Unified 1.5.0.2 IBM Storwize V7000 Unified 1.5.0.1 IBM Storwize V7000 Unified 1.5.0.0 IBM Storwize V7000 Unified 1.5 IBM Storwize V7000 Unified 1.4.3.6 IBM Storwize V7000 Unified 1.4.3.0 IBM Storwize V7000 Unified 1.4.2.1 IBM Storwize V7000 Unified 1.4.2.0 IBM Storwize V7000 Unified 1.4.1.1 IBM Storwize V7000 Unified 1.4.1.0 IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 IBM Storwize V7000 7.4 IBM Storwize V7000 7.2 IBM Storwize V7000 7.1 IBM Storwize V7000 6.4 IBM Storwize V7000 6.3 IBM Storwize V7000 6.2 IBM Storwize V7000 6.1 IBM Storwize V5000 7.4 IBM Storwize V5000 7.3 IBM Storwize V5000 7.2 IBM Storwize V5000 7.1 IBM Storwize V5000 6.4 IBM Storwize V5000 6.3 IBM Storwize V5000 6.1 IBM Storwize V3700 7.4 IBM Storwize V3700 7.3 IBM Storwize V3700 7.2 IBM Storwize V3700 7.1 IBM Storwize V3700 6.4 IBM Storwize V3700 6.3 IBM Storwize V3700 6.2 IBM Storwize V3700 6.1 IBM Storwize V3500 7.4 IBM Storwize V3500 7.3 IBM Storwize V3500 7.2 IBM Storwize V3500 7.1 IBM Storwize V3500 6.4 IBM Storwize V3500 6.3 IBM Storwize V3500 6.2 IBM Storwize V3500 6.1 IBM Sametime Unified Telephony 8.5.2 IBM Sametime Unified Telephony 9.0 IBM RRDI 5.0.2 IBM RRDI 5.0.1 IBM RRDI 2.0.6 IBM RRDI 2.0.5 IBM RRDI 2.0.4 IBM RRDI 2.0.3 IBM RRDI 2.0.1 IBM RRDI 5.0 IBM RRDI 2.0.0.1 IBM RRDI 2.0 IBM Rational Test Workbench 8.5 2 IBM Rational Test Workbench 8.5 1 IBM Rational Test Workbench 8.0.1 4 IBM Rational Test Workbench 8.0.1 3 IBM Rational Test Workbench 8.0.1 2 IBM Rational Test Workbench 8.0.1 1 IBM Rational Test Workbench 8.0.1 IBM Rational Test Workbench 8.0 3 IBM Rational Test Workbench 8.0 2 IBM Rational Test Workbench 8.0 1 IBM Rational Test Workbench 8.5.0.3 IBM Rational Test Workbench 8.5 IBM Rational Test Workbench 8.0.1.5 IBM Rational Test Workbench 8.0.0.4 IBM Rational Test Workbench 8.0 IBM Rational Lifecycle Integration Adapter for HP ALM 1.1.2 IBM Rational Lifecycle Integration Adapter for HP ALM 1.1.2.1 IBM Rational Insight 1.1.1 3 IBM Rational Insight 1.1.1 2 IBM Rational Insight 1.1.1 1 IBM Rational Insight 1.1.1 IBM Rational Insight 1.0.1 1 IBM Rational Insight 1.1.1.7 IBM Rational Insight 1.1.1.6 IBM Rational Insight 1.1.1.5 IBM Rational Insight 1.1.1.4 IBM Rational Insight 1.1 IBM Power HMC 8.2.0.0 IBM Power HMC 8.1.0.0 IBM Power HMC 7.7.9.0 IBM Power HMC 7.7.8.0 IBM Power HMC 7.7.3.0 IBM Integration Bus 10 IBM FlashSystem 900 9843-AE2 IBM FlashSystem 900 9840-AE2 IBM FlashSystem 840 9848-AE1 IBM FlashSystem 840 9848-AC1 IBM FlashSystem 840 9848-AC0 IBM FlashSystem 840 9846-AE1 IBM FlashSystem 840 9846-AC1 IBM FlashSystem 840 9846-AC0 IBM FlashSystem 840 9843-AE1 1.1.3.7 IBM FlashSystem 840 9840-AE1 1.1.3.7 IBM Cognos TM1 10.2.2 IBM Cognos TM1 9.5.2 IBM Cognos TM1 10.2 IBM Cognos TM1 10.1.1 IBM Cognos Metrics Manager 10.2.2 IBM Cognos Metrics Manager 10.2.1 IBM Cognos Metrics Manager 10.2 IBM Cognos Metrics Manager 10.1.1 IBM Cognos Metrics Manager 10.1 IBM Cognos Metrics Manager 10.2 IBM Cognos Metrics Manager 10.1 IBM Cognos Express 10.2.2 IBM Cognos Express 10.1 IBM Cognos Express 9.5.2 IBM Cognos Express 10.2.1 IBM Cognos Business Viewpoint 10.1.1 FP2 IBM Cognos Business Viewpoint 10.1 FP1 IBM Cognos Business Intelligence Server 10.2.2 IBM Cognos Business Intelligence Server 10.2.1 1 IBM Cognos Business Intelligence Server 10.2.1 IBM Cognos Business Intelligence Server 10.1.1 IBM Cognos Business Intelligence Server 8.4.1 IBM Cognos Business Intelligence Server 10.2 IBM Cognos Business Intelligence Server 10.1 IBM Algo One Algo Risk Application 5.0 IBM Algo One Algo Risk Application 4.9.1 IBM Algo One Algo Risk Application 2.5.8 IBM Algo One 5.0 IBM Algo One 4.9 IBM Algo One 4.9.1 IBM Algo One 4.8 IBM Algo Audit and Compliance 2.1 HP Tomcat 6.0.33.01 for HP-UX B.11.31 0 HP OpenVMS CSWS_JAVA 7.0.29 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apache Tomcat 8.0.8 Apache Tomcat 8.0.5 Apache Tomcat 8.0.3 Apache Tomcat 8.0.1 Apache Tomcat 7.0.54 Apache Tomcat 7.0.53 Apache Tomcat 7.0.50 Apache Tomcat 7.0.33 Apache Tomcat 7.0.32 Apache Tomcat 7.0.31 Apache Tomcat 7.0.30 Apache Tomcat 7.0.29 Apache Tomcat 7.0.28 Apache Tomcat 7.0.27 Apache Tomcat 7.0.26 Apache Tomcat 7.0.25 Apache Tomcat 7.0.24 Apache Tomcat 7.0.23 Apache Tomcat 7.0.16 Apache Tomcat 7.0.15 Apache Tomcat 7.0.14 Apache Tomcat 7.0.13 Apache Tomcat 7.0.12 Apache Tomcat 7.0.4 Apache Tomcat 7.0.3 Apache Tomcat 7.0.2 Apache Tomcat 7.0.1 Apache Tomcat 7.0 Apache Tomcat 6.0.43 Apache Tomcat 6.0.41 Apache Tomcat 6.0.37 Apache Tomcat 6.0.36 Apache Tomcat 6.0.35 Apache Tomcat 6.0.29 Apache Tomcat 6.0.28 Apache Tomcat 6.0.27 Apache Tomcat 6.0.26 Apache Tomcat 6.0.25 Apache Tomcat 6.0.24 Apache Tomcat 6.0.20 Apache Tomcat 6.0.18 Apache Tomcat 6.0.17 Apache Tomcat 6.0.16 Apache Tomcat 6.0.15 Apache Tomcat 6.0.14 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.9 Apache Tomcat 6.0.8 Apache Tomcat 6.0.7 Apache Tomcat 6.0.6 Apache Tomcat 6.0.5 Apache Tomcat 6.0.4 Apache Tomcat 6.0.3 Apache Tomcat 6.0.2 Apache Tomcat 6.0.1 Apache Tomcat 6.0 Apache Tomcat 8.0.0-RC6 Apache Tomcat 8.0.0-RC3 Apache Tomcat 8.0.0 Rc5 Apache Tomcat 8.0.0 Rc2 Apache Tomcat 8.0.0 Rc10 Apache Tomcat 8.0.0 Rc1 Apache Tomcat 7.0.5 Apache Tomcat 7.0.49 Apache Tomcat 7.0.48 Apache Tomcat 7.0.47 Apache Tomcat 7.0.46 Apache Tomcat 7.0.45 Apache Tomcat 7.0.44 Apache Tomcat 7.0.43 Apache Tomcat 7.0.42 Apache Tomcat 7.0.41 Apache Tomcat 7.0.40 Apache Tomcat 7.0.39 Apache Tomcat 7.0.38 Apache Tomcat 7.0.37 Apache Tomcat 7.0.36 Apache Tomcat 7.0.35 Apache Tomcat 7.0.34 Apache Tomcat 7.0.22 Apache Tomcat 7.0.21 Apache Tomcat 7.0.20 Apache Tomcat 7.0.19 Apache Tomcat 7.0.18 Apache Tomcat 7.0.17 Apache Tomcat 7.0.11 Apache Tomcat 7.0.10 Apache Tomcat 6.0.42 Apache Tomcat 6.0.39 Apache Tomcat 6.0.33 Apache Tomcat 6.0.32 Apache Tomcat 6.0.31 Apache Tomcat 6.0.30 Apache Tomcat 6.0.19
Not Vulnerable:	Redhat JBoss Enterprise Application Platform 6.4.7 IBM Storwize V7000 Unified 1.5.2.2 IBM Rational Test Workbench 8.5.0.4 IBM Rational Test Workbench 8.0.1.6 IBM Rational Test Workbench 8.0.0.5 IBM Integration Bus 10.0.0.1 IBM Cognos TM1 10.2.2 FP4 IBM Cognos TM1 9.5.2 FP 3 IF 8 IBM Cognos TM1 10.2.0.2 Interim Fix IBM Cognos TM1 10.1.1.2 Interim Fix IBM Cognos Express 10.2.1 FP4 IBM Algo Audit and Compliance 2.1.0.2 IF 8 HP Tomcat 6.0.45.01 for HP-UX B.11.31 0 Apache Tomcat 8.0.9 Apache Tomcat 6.0.44 Apache Tomcat 7.0.55

Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability

Apache Tomcat is prone to a denial-of-service vulnerability.

Attackers may leverage this issue to cause denial-of-service conditions.

The following versions are affected:

Apache Tomcat 8.0.0-RC1 through 8.0.8
Apache Tomcat 7.0.0 through 7.0.54
Apache Tomcat 6.0.0 through 6.0.43

Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability

References:

• Apache Tomcat Homepage (Apache)
  
• Add a new limit, defaulting to 2MB, for the amount of data Tomcat will swallow f (Apache)
  
• CVE-2014-0230 tomcat: non-persistent DoS attack by feeding data by aborting an u (Bugzilla)
  
• CVE-2014-0230: Apache Tomcat DoS (Seclists.org)
  
• HPSBOV03503 rev.1 - HP OpenVMS CSWS_JAVA running Tomcat, Multiple Remote Vulnera (HP)
  
• HPSBUX03561 rev.1 - HPE HP-UX using Apache Tomcat, Remote Access Restriction Byp (HP)
  
• IBM Advisory ssg1S1005258 (IBM)
  
• IBM Advisory swg21961088 (IBM)
  
• IBM Advisory swg21963664 (IBM)
  
• IBM Advisory swg21966177 (IBM)
  
• IBM Advisory swg21966846 (IBM)
  
• IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (C (IBM)
  
• Open Source Apache Tomcat vulnerability - Reported in 04/09/2015 X-Force Report (IBM)
  
• Rational Test Control Panel component in Rational Test Workbench and Rational Te (IBM)
  
• Red Hat JBoss Web Server 2.1.0 tomcat security update (Red Hat)
  
• RHSA-2016-0595 Red Hat JBoss EAP 6.4.7 update (Redhat)
  
• RHSA-2016-0596 Red Hat JBoss EAP 6.4.7 update (Redhat)
  
• RHSA-2016-0597 Red Hat JBoss EAP 6.4.7 update (Redhat)
  
• RHSA-2016-0598 jboss-ec2-eap security, bug fix, and enhancement update (Redhat)
  
• RHSA-2016-0599 jboss-ec2-eap security, bug fix, and enhancement update (Redhat)
  
• Security Bulletin: A vulnerability in Open Source Apache Tomcat affect the IBM F (IBM)
  
• Security Bulletin: A vulnerability in Open Source Apache Tomcat affects IBM Flas (IBM)
  
• Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM (IBM)
  
• Security Bulletin: Apache Tomcat vulnerabilities affect IBM SAN Volume Controlle (IBM)
  
• Security Bulletin: IBM Cognos Business Intelligence Sever 2015Q3 Security Update (IBM)
  
• Security Bulletin: IBM Integration Bus is affected by Apache Tomcat vulnerabilit (IBM)
  
• Security Bulletin: Multiple security vulnerabilities in Open Source Apache Tomca (IBM)
  
• Security Bulletin: Vulnerabilities in Tomcat affect Power Hardware Management Co (IBM)
  
• Security Bulletin: Vulnerability in Apache Tomcat affects Rational Lifecycle Int (IBM)
  
• Security Bulletin: Vulnerability in Tomcat affects IBM Cognos Metrics Manager (C (IBM)
  
• swg21963184: Security Bulletin: A security vulnerability in Apache Tomcat affect (IBM)
  
• swg21963185: Security Bulletin: A security vulnerability in Apache Tomcat affect (IBM)
  
• swg21967384 Security Bulletin: Multiple vulnerability in Product IBM Tivoli (IBM)
  
• swg21972376 : Multiple Security Vulnerabilities exist in IBM Cognos Express. (IBM)