Vulnerability CVE-2007-6286

Vulnerability CVE-2007-6286

Published: 2008-02-11 Modified: 2012-02-12

Description:

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Tomcat duplicate request processing vulnerability	Mark Thomas	12.02.2008

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Apache -> Tomcat

References:

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

http://marc.info/?l=bugtraq&m=139344343412337&w=2

http://security.gentoo.org/glsa/glsa-200804-10.xml

http://securityreason.com/securityalert/3637

http://support.apple.com/kb/HT3216

http://tomcat.apache.org/security-5.html

http://tomcat.apache.org/security-6.html

http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

http://www.securityfocus.com/archive/1/487823/100/0/threaded

http://www.securityfocus.com/archive/1/507985/100/0/threaded

http://www.securityfocus.com/bid/31681

http://www.vmware.com/security/advisories/VMSA-2008-0010.html

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

http://www.vupen.com/english/advisories/2008/0488

http://www.vupen.com/english/advisories/2008/1856/references

http://www.vupen.com/english/advisories/2008/2780

http://www.vupen.com/english/advisories/2009/3316

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html

Vulnerability CVE-2007-6286

See advisories in our WLB2 database:

Med.

Tomcat duplicate request processing vulnerability

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

4.3/10

2.9/10

8.6/10

Remote

Medium

No required

None

Partial

None

Affected software

References: