Apache Tomcat Web form hash conflict Denial of Service Vulnerability

Release date: 2011-12-29
Updated on: 2011-12-30

Affected Systems:
Apache Group Tomcat 7.x
Apache Group Tomcat 6.x
Apache Group Tomcat 5.x
Unaffected system:
Apache Group Tomcat 7.0.23
Apache Group Tomcat 6.0.35
Apache Group Tomcat 5.5.35
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51200

Tomcat is a Servlet container developed by the Jakarta project under the Apache Software Foundation. According to the technical specifications provided by Sun Microsystems, Tomcat supports Servlet and JavaServer Page (JSP, it also provides some special functions as Web servers, such as Tomcat Management and Control Platform, security domain management, and Tomcat valve.

When Tomcat processes the posting and updating of hash forms, there is an error in the hash generation function. By sending a specially crafted form in the http post request, attackers can exploit this vulnerability to cause DOS.

<* Source: Alexander Klink (a.klink@cynops.de)

Link: http://www.nruns.com/_downloads/advisory28122011.pdf
Http://www.ocert.org/advisories/ocert-2011-003.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://jakarta.apache.org/tomcat/index.html