Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

The remote Solaris system is missing necessary patches to address security updates :

  - Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x     before 7.0.23 computes hash values for form parameters     without restricting the ability to trigger hash     collisions predictably, which allows remote attackers to     cause a denial of service (CPU consumption) by sending     many crafted parameters. (CVE-2011-4858)

  - Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34,     and 7.x before 7.0.23 uses an inefficient approach for     handling parameters, which allows remote attackers to     cause a denial of service (CPU consumption) via a     request that contains many parameters and parameter     values, a different vulnerability than CVE-2011-4858.
    (CVE-2012-0022)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0682 advisory.

  - tomcat: Multiple weaknesses in HTTP DIGEST authentication (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,     CVE-2011-5064)

  - tomcat: password disclosure vulnerability (CVE-2011-2204)

  - tomcat: security manager restrictions bypass (CVE-2011-2526)

  - tomcat: authentication bypass and information disclosure (CVE-2011-3190)

  - tomcat: information disclosure due to improper response and request object recycling (CVE-2011-3375)

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0680 advisory.

  - tomcat: Multiple weaknesses in HTTP DIGEST authentication (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,     CVE-2011-5064)

  - tomcat: password disclosure vulnerability (CVE-2011-2204)

  - tomcat: security manager restrictions bypass (CVE-2011-2526)

  - tomcat: authentication bypass and information disclosure (CVE-2011-3190)

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The apache tomcat was vulnerable to a hash collision attack which allowed remote attackers to mount DoS attacks. CVE-2011-4858 has been assigned to this issue.

Tomcat was vulnerable to a hash collision attack which allowed remote attackers to mount DoS attacks.

From Red Hat Security Advisory 2012:0475 :

Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

Red Hat would like to thank oCERT for reporting CVE-2011-4858. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4858.

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0474 advisory.

    - Resolves: CVE-2012-0022, CVE-2011-4858
    - Resolves CVE-2011-0013 rhbz 675933
    - Resolves CVE-2011-3718 rhbz 675933
    - Resolves CVE-2011-1184 rhbz 744984

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0074 advisory.

  - tomcat: Multiple weaknesses in HTTP DIGEST authentication (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,     CVE-2011-5064)

  - tomcat: security manager restrictions bypass (CVE-2011-2526)

  - JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary     (CVE-2011-4610)

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022) 

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

Red Hat would like to thank oCERT for reporting CVE-2011-4858. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4858.

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0475 advisory.

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0474 advisory.

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat5 packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue.
The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make Tomcat use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values.
This update introduces limits on the number of parameters and headers processed per request to address this issue. Refer to the CVE-2011-4858 description for information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

Red Hat would like to thank oCERT for reporting CVE-2011-4858. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4858.

Users of Tomcat should upgrade to these updated packages, which correct these issues. Tomcat must be restarted for this update to take effect.

Versions of Tomcat 5.x earlier than 5.5.35 are potentially affected by a denial of service vulnerability.  Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.

Versions of Tomcat 7.0.x earlier than 7.0.23 are potentially affected by a denial of service vulnerability.  Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.

Versions of Apache Tomcat 6.0.35 are potentially affected by multiple vulnerabilities :

  - Specially crafted requests are incorrectly processed by Tomcat and can cause the server to allow injection of arbitrary AJP messages.  This can lead to authentication bypass and disclosure of sensitive information.  Note this vulnerability only occurs when the following are true (CVE-2011-3190):

    - the org.apache.jk.server.JkCoyoteHandler AJP connector is not used.
    - POST requests are accepted.
    - Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions. (CVE-2011-4858, CVE-2012-0022)
IAVB Reference : 2012-B-0035
STIG Finding Severity : Category I

According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.23. It is, therefore, affected by a denial of service vulnerability.

Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 5.x listening on the remote host is prior to 5.5.35. It is, therefore, affected by a denial of service vulnerability.

Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that Tomcat incorrectly performed certain caching and recycling operations. A remote attacker could use this flaw to obtain read access to IP address and HTTP header information in certain cases. This issue only applied to Ubuntu 11.10.
(CVE-2011-3375)

It was discovered that Tomcat computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by sending many crafted parameters. (CVE-2011-4858)

It was discovered that Tomcat incorrectly handled parameters. A remote attacker could cause a denial of service by sending requests with a large number of parameters and values. (CVE-2012-0022).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update for tomcat5 fixes a vulnerability to a hash collision attack which allows remote attackers to perform denial of service attacks. The issue is tracked as CVE-2011-4858.

Several vulnerabilities have been found in Tomcat, a servlet and JSP engine :

  - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064     The HTTP Digest Access Authentication implementation     performed insufficient countermeasures against replay     attacks.

  - CVE-2011-2204     In rare setups passwords were written into a logfile.

  - CVE-2011-2526     Missing input sanitising in the HTTP APR or HTTP NIO     connectors could lead to denial of service.

  - CVE-2011-3190     AJP requests could be spoofed in some setups.

  - CVE-2011-3375     Incorrect request caching could lead to information     disclosure.

  - CVE-2011-4858 CVE-2012-0022     This update adds countermeasures against a collision     denial of service vulnerability in the Java hashtable     implementation and addresses denial of service     potentials when processing large amounts of requests.

Additional information can be found at

According to its self-reported version number, the instance of Apache Tomcat 5.x listening on the remote host is prior to 5.5.35. It is, therefore, affected by a denial of service vulnerability.

Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 6.x listening on the remote host is prior to 6.0.35. It is, therefore, affected by multiple vulnerabilities :

  - Specially crafted requests are incorrectly processed     by Tomcat and can cause the server to allow injection     of arbitrary AJP messages. This can lead to     authentication bypass and disclosure of sensitive     information. (CVE-2011-3190)

  - An information disclosure vulnerability exists. Request     information is cached in two objects and these objects     are not recycled at the same time. Further requests can     obtain sensitive information if certain error conditions     occur. (CVE-2011-3375)

  - Large numbers of crafted form parameters can cause     excessive CPU consumption due to hash collisions.
    (CVE-2011-4858, CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
80790	Oracle Solaris Third-Party Patch Update : tomcat (multiple_denial_of_service_dos)	Nessus	Solaris Local Security Checks	medium
78925	RHEL 5 / 6 : tomcat6 (RHSA-2012:0682)	Nessus	Red Hat Local Security Checks	high
78924	RHEL 5 / 6 : tomcat5 (RHSA-2012:0680)	Nessus	Red Hat Local Security Checks	high
76036	openSUSE Security Update : tomcat6 (openSUSE-SU-2012:0103-1)	Nessus	SuSE Local Security Checks	medium
75764	openSUSE Security Update : tomcat6 (openSUSE-SU-2012:0103-1)	Nessus	SuSE Local Security Checks	medium
74554	openSUSE Security Update : tomcat6 (openSUSE-2012-129)	Nessus	SuSE Local Security Checks	medium
68511	Oracle Linux 6 : tomcat6 (ELSA-2012-0475)	Nessus	Oracle Linux Local Security Checks	medium
68510	Oracle Linux 5 : tomcat5 (ELSA-2012-0474)	Nessus	Oracle Linux Local Security Checks	medium
64022	RHEL 5 / 6 : jbossweb (RHSA-2012:0074)	Nessus	Red Hat Local Security Checks	medium
61300	Scientific Linux Security Update : tomcat6 on SL6.x (20120411)	Nessus	Scientific Linux Local Security Checks	medium
61299	Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64 (20120411)	Nessus	Scientific Linux Local Security Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58752	CentOS 6 : tomcat6 (CESA-2012:0475)	Nessus	CentOS Local Security Checks	medium
58719	RHEL 6 : tomcat6 (RHSA-2012:0475)	Nessus	Red Hat Local Security Checks	medium
58718	RHEL 5 : tomcat5 (RHSA-2012:0474)	Nessus	Red Hat Local Security Checks	medium
58685	CentOS 5 : tomcat5 (CESA-2012:0474)	Nessus	CentOS Local Security Checks	medium
800626	Apache Tomcat 5.5.x < 5.5.35 Hash Collision Denial of Service	Log Correlation Engine	Web Servers	medium
800616	Apache Tomcat 7.0.x < 7.0.23 Hash Collision Denial of Service	Log Correlation Engine	Web Servers	medium
800607	Apache Tomcat 6.0.x < 6.0.35 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
6334	Apache Tomcat 7.0.x < 7.0.23 Hash Collision DoS	Nessus Network Monitor	Web Servers	medium
6331	Apache Tomcat 5.5.x < 5.5.35 Hash Collision Denial of Service	Nessus Network Monitor	Web Servers	medium
57933	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : tomcat6 vulnerabilities (USN-1359-1)	Nessus	Ubuntu Local Security Checks	medium
57843	SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7933)	Nessus	SuSE Local Security Checks	medium
57812	Debian DSA-2401-1 : tomcat6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
57540	Apache Tomcat 5.x < 5.5.35 Hash Collision Denial of Service	Nessus	Web Servers	medium
57080	Apache Tomcat 6.x < 6.0.35 Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2011-4858

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

high

medium

high