Security Bulletin: Apache Commons FileUpload is vulnerable to a denial of service (CVEID: CVE-2014-0050) in IBM Content Manager Services for Lotus Quickr

Summary

Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for multipart requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop.

Vulnerability Details

CVEID: CVE-2014-0050

Apache Commons FileUpload and Tomcat are vulnerable to a denial of service

CVSS Base Score: 5.0
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/90987&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM Content Manager Services for Lotus Quickr 1.0 and 1.1

Remediation/Fixes

Go to www.ibm.com/support/fixcentral , search for “Content Manager Services for Lotus Quickr,” and apply the fixes below:

Version 1.0: Upgrade to version 1.1 and apply 1.1.0.3-CMQS-IF002
Version 1.1: Apply 1.1.0.3-CMQS-IF002

Workarounds and Mitigations

None