Executive Summary

Informations
Name MDVSA-2014:056 First vendor Publication 2014-03-13
Vendor Mandriva Last vendor Modification 2014-03-13
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Updated apache-commons-fileupload packages fix security vulnerability:

It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).

Tomcat 7 includes an embedded copy of the Apache Commons FileUpload package, and was affected as well.

Additionally a build problem with maven was discovered, fixed maven packages is also being provided with this advisory.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:056

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22111
 
Oval ID: oval:org.mitre.oval:def:22111
Title: DSA-2856-1 libcommons-fileupload-java - CVE-2014-0050
Description: It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition.
Family: unix Class: patch
Reference(s): DSA-2856-1
CVE-2014-0050
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): libcommons-fileupload-java
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24367
 
Oval ID: oval:org.mitre.oval:def:24367
Title: USN-2130-1 -- tomcat6, tomcat7 vulnerabilities
Description: Several security issues were fixed in Tomcat.
Family: unix Class: patch
Reference(s): USN-2130-1
CVE-2013-4286
CVE-2013-4322
CVE-2014-0033
CVE-2014-0050
Version: 5
Platform(s): Ubuntu 13.10
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): tomcat7
tomcat6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24488
 
Oval ID: oval:org.mitre.oval:def:24488
Title: RHSA-2014:0429: tomcat6 security update (Moderate)
Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests. (CVE-2013-4286) It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default. (CVE-2013-4322) A denial of service flaw was found in the way Apache Commons FileUpload handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing JBoss Web to enter an infinite loop when processing such an incoming request. (CVE-2014-0050) All Tomcat users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:0429-00
CESA-2014:0429
CVE-2013-4286
CVE-2013-4322
CVE-2014-0050
Version: 5
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): tomcat6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24843
 
Oval ID: oval:org.mitre.oval:def:24843
Title: ELSA-2014:0429: tomcat6 security update (Moderate)
Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests. (CVE-2013-4286) It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default. (CVE-2013-4322) A denial of service flaw was found in the way Apache Commons FileUpload handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing JBoss Web to enter an infinite loop when processing such an incoming request. (CVE-2014-0050) All Tomcat users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.
Family: unix Class: patch
Reference(s): ELSA-2014:0429-00
CVE-2013-4286
CVE-2013-4322
CVE-2014-0050
Version: 5
Platform(s): Oracle Linux 6
Product(s): tomcat6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25499
 
Oval ID: oval:org.mitre.oval:def:25499
Title: SUSE-SU-2014:0548-1 -- Security update for jakarta-commons-fileupload
Description: This update fixes a security issue with jakarta-commons-fileupload: * bnc#862781: denial of service due to too-small buffer size used (CVE-2014-0050) Security Issue reference: * CVE-2014-0050 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050 >
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0548-1
CVE-2014-0050
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): jakarta-commons-fileupload
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 6
Application 59
Application 8

ExploitDB Exploits

id Description
2014-02-12 Apache Commons FileUpload and Apache Tomcat Denial-of-Service

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-07-03 IAVM : 2014-B-0090 - Multiple Vulnerabilities in VMware vCenter Operations
Severity : Category I - VMSKEY : V0052895
2014-05-29 IAVM : 2014-B-0065 - Multiple Vulnerabilities in IBM WebSphere Application Server
Severity : Category I - VMSKEY : V0051617
2014-02-27 IAVM : 2014-B-0019 - Multiple Vulnerabilities in Apache Tomcat
Severity : Category I - VMSKEY : V0044527

Snort® IPS/IDS

Date Description
2014-03-22 Apache Tomcat infinite loop denial of service attempt
RuleID : 29896 - Revision : 2 - Type : SERVER-APACHE

Nessus® Vulnerability Scanner

Date Description
2015-05-14 Name : The website content management system installed on the remote host is affecte...
File : oracle_webcenter_sites_apr_2015_cpu.nasl - Type : ACT_GATHER_INFO
2015-05-08 Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_3_0_11.nasl - Type : ACT_GATHER_INFO
2015-05-08 Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_2_3_17.nasl - Type : ACT_GATHER_INFO
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-084.nasl - Type : ACT_GATHER_INFO
2015-01-30 Name : The remote web server contains a web application that uses a Java framework t...
File : struts_2_3_16_1_win_local.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-29.nasl - Type : ACT_GATHER_INFO
2014-10-24 Name : The remote host has a virtualization application installed that is affected b...
File : vmware_orchestrator_vmsa_2014_0007.nasl - Type : ACT_GATHER_INFO
2014-10-24 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vmware_orchestrator_appliance_vmsa_2014_0007.nasl - Type : ACT_GATHER_INFO
2014-10-21 Name : The remote host is affected by multiple vulnerabilities.
File : oracle_eids_cpu_oct_2014.nasl - Type : ACT_GATHER_INFO
2014-10-17 Name : The remote database server is affected by multiple vulnerabilities.
File : oracle_rdbms_cpu_oct_2014.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-344.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15189.nasl - Type : ACT_GATHER_INFO
2014-09-17 Name : The remote host has a virtualization management application installed that is...
File : vmware_vcenter_vmsa-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-09-11 Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-08-04 Name : The remote application server is affected by multiple vulnerabilities.
File : websphere_8_0_0_9.nasl - Type : ACT_GATHER_INFO
2014-08-01 Name : The remote application server is affected by multiple vulnerabilities.
File : websphere_7_0_0_33.nasl - Type : ACT_GATHER_INFO
2014-07-10 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140709_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-07-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-10 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-10 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO
2014-07-07 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vcenter_operations_manager_vmsa_2014-0007.nasl - Type : ACT_GATHER_INFO
2014-06-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0526.nasl - Type : ACT_GATHER_INFO
2014-06-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0525.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-298.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-297.nasl - Type : ACT_GATHER_INFO
2014-06-03 Name : The remote Windows host has web portal software installed that is affected by...
File : websphere_portal_cve-2014-0050.nasl - Type : ACT_GATHER_INFO
2014-05-29 Name : The remote application server may be affected by multiple vulnerabilities.
File : websphere_8_5_5_2.nasl - Type : ACT_GATHER_INFO
2014-05-23 Name : The remote Windows host has web portal software installed that is affected by...
File : websphere_portal_8_0_0_1_cf12.nasl - Type : ACT_GATHER_INFO
2014-04-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0429.nasl - Type : ACT_GATHER_INFO
2014-04-24 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0429.nasl - Type : ACT_GATHER_INFO
2014-04-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0429.nasl - Type : ACT_GATHER_INFO
2014-04-24 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140423_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-04-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_jakarta-commons-fileupload-140403.nasl - Type : ACT_GATHER_INFO
2014-04-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2897.nasl - Type : ACT_GATHER_INFO
2014-03-28 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-312.nasl - Type : ACT_GATHER_INFO
2014-03-14 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-056.nasl - Type : ACT_GATHER_INFO
2014-03-07 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2130-1.nasl - Type : ACT_GATHER_INFO
2014-03-06 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0253.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote Apache Tomcat server is affected by a denial of service vulnerabil...
File : tomcat_8_0_3.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote Apache Tomcat server is affected by a denial of service vulnerabil...
File : tomcat_7_0_52.nasl - Type : ACT_GATHER_INFO
2014-02-18 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2183.nasl - Type : ACT_GATHER_INFO
2014-02-18 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2175.nasl - Type : ACT_GATHER_INFO
2014-02-10 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2856.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2016-01-22 09:26:24
  • Multiple Updates
2015-11-06 00:26:09
  • Multiple Updates
2014-04-01 17:29:49
  • Multiple Updates
2014-04-01 14:45:05
  • Multiple Updates
2014-03-15 13:21:37
  • Multiple Updates
2014-03-13 13:19:34
  • First insertion