RedhatCVELIST:CVE-2007-6286CVE-2007-6286
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of โa duplicate copy of one of the recent requests,โ as demonstrated by using netcat to send the empty request.
References
lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
marc.info/?l=bugtraq&m=139344343412337&w=2
secunia.com/advisories/28878
secunia.com/advisories/28915
secunia.com/advisories/29711
secunia.com/advisories/30676
secunia.com/advisories/32222
secunia.com/advisories/37460
secunia.com/advisories/57126
security.gentoo.org/glsa/glsa-200804-10.xml
securityreason.com/securityalert/3637
support.apple.com/kb/HT3216
tomcat.apache.org/security-5.html
tomcat.apache.org/security-6.html
www.mandriva.com/security/advisories?name=MDVSA-2009:136
www.securityfocus.com/archive/1/487823/100/0/threaded
www.securityfocus.com/archive/1/507985/100/0/threaded
www.securityfocus.com/bid/31681
www.vmware.com/security/advisories/VMSA-2008-0010.html
www.vmware.com/security/advisories/VMSA-2009-0016.html
www.vupen.com/english/advisories/2008/0488
www.vupen.com/english/advisories/2008/1856/references
www.vupen.com/english/advisories/2008/2780
www.vupen.com/english/advisories/2009/3316
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html
www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html
Related
