Detections
Analytics
Apache Tomcat 8.5.0 < 8.5.13 multiple vulnerabilities
critical Nessus Plugin ID 99368
Language:
Synopsis
The remote Apache Tomcat server is affected by multiple vulnerabilitiesDescription
The version of Tomcat installed on the remote host is prior to 8.5.13. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.13_security-8 advisory.- In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. (CVE-2017-5651)
- In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads. (CVE-2017-5650)
- A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. (CVE-2017-5647)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Apache Tomcat version 8.5.13 or later.See Also
http://www.nessus.org/u?b0a1d27b
https://svn.apache.org/viewvc?view=rev&rev=1788480
Plugin Details
Severity: Critical
ID: 99368
File Name: tomcat_8_5_13.nasl
Version: 1.15
Type: combined
Agent: windows, macosx, unix
Family: Web Servers
Published: 4/14/2017
Updated: 5/23/2024
Configuration: Enable thorough checks
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2017-5651
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:tomcat:8
Required KB Items: installed_sw/Apache Tomcat
Exploit Ease: No known exploits are available
Patch Publication Date: 3/30/2017
Vulnerability Publication Date: 3/24/2017