[SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.29 Tomcat 6.0.0 to 6.0.27 Tomcat 7.0.0 Note: 7.0.0 is stil...

CVE-2010-2227: Improper Restriction of Operations within the Bounds of a Memory Buffer

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service application outage or obtain sensitive information via a crafted header that interferes with "recycling...

Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

Apache Tomcat is prone to multiple remote vulnerabilities including information-disclosure and denial-of-service issues. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Apache Tomcat JSP2 Examples XSS

The remote Apache Tomcat installation is affected by multiple cross-site scripting vulnerabilities because several of the JSP example scripts do not properly validate user input. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Fixed in Apache Tomcat 6.0.28

Important: Remote Denial Of Service and Information Disclosure Vulnerability CVE-2010-2227 Several flaws in the handling of the 'Transfer-Encoding' header were found that prevented the recycling of a buffer. A remote attacker could trigger this flaw which would cause subsequent requests to fail...

Apache Tomcat Transfer-Encoding Information Disclosure and DoS

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service application outage or obtain sensitive information via a crafted header that interferes with "recycling...

Apache Tomcat Implicit Objects XSS

The remote Apache Tomcat server is affected by a cross-site scripting vulnerability in the 'jsp-examples/jsp2/el/implicit-objects.jsp' example webapp due to a failure to properly filter user-supplied header values. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Apache Tomcat User Enumeration

This module enumerates Apache Tomcat's usernames via malformed requests to jsecuritycheck, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default...

Apache Tomcat < 5.5.26 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 5.5.26. It is, therefore, affected by multiple vulnerabilities : - The remote Apache Tomcat install may be vulnerable to an information disclosure attack via cookies. The previous...

Apache Tomcat < 6.0.16 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 6.0.16. It is, therefore, affected by multiple vulnerabilities : - The remote Apache Tomcat install may be vulnerable to an information disclosure attack via cookies. The previous...

Apache Tomcat < 6.0.18 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 6.0.18. It is, therefore, affected by multiple vulnerabilities : - The remote Apache Tomcat installation is affected by a cross-site scripting vulnerability in the...

Preemptive Protection against HP Performance Manager Apache Tomcat Policy Bypass

A vulnerability exists in HP Performance Manager, a web-based analysis and visualization tool that analyzes performance trends of applications, systems, and services. HP Performance Manager incorporates Apache Tomcat 5 to help serve custom web applications. The vulnerability is due to insufficien...

CVE-2010-1622: Spring Framework execution of arbitrary code

CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be affected Description: The Spring...

HP Operations Manager hidden Tomcat account

Added: 06/18/2010 CVE: CVE-2009-3843 BID: 37086 OSVDB: 60317 Background HP Operations Manager is a consolidated event and performance management console that correlates infrastructure, network and end-user experience events across an IT infrastructure. Problem A hidden Apache Tomcat account allow...

Spring Framework - Arbitrary code Execution

Spring Framework - Arbitrary code Execution CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions ma...

Spring Framework - Arbitrary code Execution

CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be affected Description: The Spring...

HP Operations Manager hidden Tomcat account

Added: 06/18/2010 CVE: CVE-2009-3843 BID: 37086 OSVDB: 60317 Background HP Operations Manager is a consolidated event and performance management console that correlates infrastructure, network and end-user experience events across an IT infrastructure. Problem A hidden Apache Tomcat account allow...

Apache Tomcat 4.x < 4.1.37 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.37. It is, therefore, affected by the following vulnerabilities : - The remote Apache Tomcat install may be vulnerable to an information disclosure attack if the deprecate...

Apache Tomcat 5.x < 5.5.1 Information Disclosure

According to its self-reported version number, the instance of Apache Tomcat 5.x listening on the remote host is prior to 5.5.1. It is, therefore, affected by an information disclosure vulnerability. Specifically, it may allow requests from a non-permitted IP address to gain access to a context...

Apache Tomcat 4.x < 4.1.32 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.32. It is, therefore, affected by the following vulnerabilities : - The remote Apache Tomcat install is vulnerable to a denial of service attack. If directory listing is...