Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to Denial of Service Attack. (CVE-2014-0230)

Summary

Open Source Apache Tomcat vulnerability - Reported in 04/09/2015 X-Force Report

Vulnerability Details

CVE-ID: CVE-2014-0230

Description: Apache Tomcat is vulnerable to a denial of service, caused by missing limitations on request body size. By sending a specially crafted request to the server, an attacker could keep a connection open and force Tomcat to keep a processing thread allocated to the connection.

CVSS Base Score: 5.0 **CVSS Temporal Score:**See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102131 for the current score **CVSS Environmental Score:***Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected Products and Versions

· IBM QRadar SIEM 7.2.n

· IBM QRadar SIEM 7.1.n

Remediation/Fixes

· IBM QRadar/QRM/QVM/QRIF 7.2.5 Patch 5

· IBM QRadar SIEM 7.1 MR2 Patch 11 Interim Fix 3

Workarounds and Mitigations

None