Многочисленные уязвимости безопасности в Apache Tomcat

Многочисленные уязвимости безопасности в Apache Tomcat дополнено с 28 февраля 2014 г.
Опубликовано:		31 марта 2014 г.
Источник:		BUGTRAQ
SecurityVulns ID:		13578
Тип:		удаленная
Уровень опасности:		6/10
Описание:		Утечка информации, DoS, фиксация сеансов.

Затронутые продукты:		APACHE : Tomcat 7.0
		APACHE : Tomcat 8.0
CVE:		CVE-2014-0050 (MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.)
		CVE-2014-0033 (org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.)
		CVE-2013-4590 (Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.)
		CVE-2013-4322 (Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.)
		CVE-2013-4286 (Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.)

Оригинальный текст		APACHE, [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS (31.03.2014)
		APACHE, [SECURITY] CVE-2013-4590 Information disclosure via XXE when running untrusted web applications (28.02.2014)
		APACHE, [SECURITY] CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service) (28.02.2014)
		APACHE, [SECURITY] CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure) (28.02.2014)
		APACHE, [SECURITY] CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled (28.02.2014)