The version of Tomcat installed on the remote host is prior to 7.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.53_security-7 advisory.

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption)     via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
    (CVE-2014-0075)

  - java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before     6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows     remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web     application that provides an XML external entity declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue. (CVE-2014-0096)

  - Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct     HTTP request smuggling attacks via a crafted Content-Length HTTP header. (CVE-2014-0099)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.0.5_security-8 advisory.

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption)     via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
    (CVE-2014-0075)

  - java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote     attackers to cause a denial of service (thread consumption) by using a Content-Length: 0 AJP request to     trigger a hang in request processing. (CVE-2014-0095)

  - java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before     6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows     remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web     application that provides an XML external entity declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue. (CVE-2014-0096)

  - Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct     HTTP request smuggling attacks via a crafted Content-Length HTTP header. (CVE-2014-0099)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tomcat Security Team reports :

Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

An integer overflow, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

An integer overflow in parseChunkHeader allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Tomcat has been updated to version 6.0.41, which brings security and bug fixes.

The following security fixes have been fixed :

  - A XXE vulnerability via user-supplied XSLTs.
    (CVE-2014-0096)

  - Request smuggling via malicious content length header.
    (CVE-2014-0099)

  - A XML parser hijack by malicious web application. Bugs     fixed:. (CVE-2014-0119)

  - Socket bind fails on tomcat startup when using apr     (IPV6). (bnc#881700)

  - classpath for org/apache/juli/logging/LogFactory     (bnc#844689)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Updated tomcat packages fix security vulnerabilities :

Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a Transfer-Encoding: chunked header (CVE-2013-4286).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.
(CVE-2014-0075)

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096)

It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)

It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service. (CVE-2014-0227)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-451:03 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2014-0075     Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption)     via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
    CVE-2014-0096     java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before     6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows     remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web     application that provides an XML external entity declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue.
    CVE-2014-0099     Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct     HTTP request smuggling attacks via a crafted Content-Length HTTP header.
    fixed bugs:
    * Previously, the CVE-2014-0050 issue contained redundant code, and remove the redundant code.
    * Previously,  the CVE-2013-4322 issue contained an invalid check that triggered a java.io.EOFException     while reading trailer headers for chunked requests. This update fixes the check.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:0843 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    It was discovered that JBoss Web did not limit the length of chunk sizes     when using chunked transfer encoding. A remote attacker could use this flaw     to perform a denial of service attack against JBoss Web by streaming an     unlimited quantity of data, leading to excessive consumption of server     resources. (CVE-2014-0075)

    It was found that JBoss Web did not check for overflowing values when     parsing request content length headers. A remote attacker could use this     flaw to perform an HTTP request smuggling attack on a JBoss Web server     located behind a reverse proxy that processed the content length header     correctly. (CVE-2014-0099)

    It was found that the org.apache.catalina.servlets.DefaultServlet     implementation in JBoss Web allowed the definition of XML External Entities     (XXEs) in provided XSLTs. A malicious application could use this to     circumvent intended security restrictions to disclose sensitive     information. (CVE-2014-0096)

    It was found that, in certain circumstances, it was possible for a     malicious web application to replace the XML parsers used by JBoss Web to     process XSLTs for the default servlet, JSP documents, tag library     descriptors (TLDs), and tag plug-in configuration files. The injected XML     parser(s) could then bypass the limits imposed on XML external entities     and/or gain access to the XML files processed for other web applications     deployed on the same JBoss Web instance. (CVE-2014-0119)

    The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product     Security.

    All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat     Enterprise Linux 5 and 6 are advised to upgrade to these updated packages.
    The JBoss server process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat6 packages that fix three security issues and two bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075)

It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099)

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096)

The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security.

This update also fixes the following bugs :

* The patch that resolved the CVE-2014-0050 issue contained redundant code. This update removes the redundant code. (BZ#1094528)

* The patch that resolved the CVE-2013-4322 issue contained an invalid check that triggered a java.io.EOFException while reading trailer headers for chunked requests. This update fixes the check and the aforementioned exception is no longer triggered in the described scenario. (BZ#1095602)

All Tomcat 6 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075)

It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099)

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096)

This update also fixes the following bugs :

  - The patch that resolved the CVE-2014-0050 issue     contained redundant code. This update removes the     redundant code.

  - The patch that resolved the CVE-2013-4322 issue     contained an invalid check that triggered a     java.io.EOFException while reading trailer headers for     chunked requests. This update fixes the check and the     aforementioned exception is no longer triggered in the     described scenario.

Tomcat must be restarted for this update to take effect.

The remote Solaris system is missing necessary patches to address security updates :

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/     http11/filters/ChunkedInputFilter.java in Apache Tomcat     before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4     allows remote attackers to cause a denial of service     (resource consumption) via a malformed chunk size in     chunked transfer coding of a request during the     streaming of data. (CVE-2014-0075)

  - java/org/apache/catalina/servlets/DefaultServlet.java in     the default servlet in Apache Tomcat before 6.0.40, 7.x     before 7.0.53, and 8.x before 8.0.4 does not properly     restrict XSLT stylesheets, which allows remote attackers     to bypass security-manager restrictions and read     arbitrary files via a crafted web application that     provides an XML external entity declaration in     conjunction with an entity reference, related to an XML     External Entity (XXE) issue. (CVE-2014-0096)

  - Integer overflow in     java/org/apache/tomcat/util/buf/Ascii.java in Apache     Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before     8.0.4, when operated behind a reverse proxy, allows     remote attackers to conduct HTTP request smuggling     attacks via a crafted Content-Length HTTP header.
    (CVE-2014-0099)

  - Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x     before 8.0.6 does not properly constrain the class     loader that accesses the XML parser used with an XSLT     stylesheet, which allows remote attackers to (1) read     arbitrary files via a crafted web application that     provides an XML external entity declaration in     conjunction with an entity reference, related to an XML     External Entity (XXE) issue, or (2) read files     associated with different web applications on a single     Tomcat instance via a crafted web application.
    (CVE-2014-0119)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct     HTTP request smuggling attacks via a crafted Content-Length HTTP header. (CVE-2014-0099)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74246	Apache Tomcat 7.0.0 < 7.0.53 multiple vulnerabilities	Nessus	Web Servers	2014/5/30	2024/5/23	medium
74248	Apache Tomcat 8.0.0-RC1 < 8.0.5 multiple vulnerabilities	Nessus	Web Servers	2014/5/30	2024/5/23	medium
76719	FreeBSD : tomcat -- multiple vulnerabilities (81fc1076-1286-11e4-bebd-000c2980a9f3)	Nessus	FreeBSD Local Security Checks	2014/7/24	2021/1/6	medium
77197	SuSE 11.3 Security Update : tomcat6 (SAT Patch Number 9487)	Nessus	SuSE Local Security Checks	2014/8/14	2021/1/19	medium
78187	F5 Networks BIG-IP : Apache Tomcat vulnerability (SOL15432)	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/3/10	medium
81935	Mandriva Linux Security Advisory : tomcat (MDVSA-2015:052)	Nessus	Mandriva Local Security Checks	2015/3/19	2021/1/6	medium
83496	Amazon Linux AMI : tomcat7 (ALAS-2015-526)	Nessus	Amazon Linux Local Security Checks	2015/5/18	2018/4/18	medium
288891	MiracleLinux 4 : tomcat6-6.0.24-72.AXS4 (AXSA:2014-451:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	medium
76401	RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 6.2.4 (RHSA-2014:0843)	Nessus	Red Hat Local Security Checks	2014/7/8	2025/3/20	medium
76446	RHEL 6 : tomcat6 (RHSA-2014:0865)	Nessus	Red Hat Local Security Checks	2014/7/10	2021/1/14	medium
76450	Scientific Linux Security Update : tomcat6 on SL6.x i386/srpm/x86_64 (20140709)	Nessus	Scientific Linux Local Security Checks	2014/7/10	2021/1/14	high
80794	Oracle Solaris Third-Party Patch Update : tomcat (cve_2014_0075_numeric_errors)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
83497	Amazon Linux AMI : tomcat8 (ALAS-2015-527)	Nessus	Amazon Linux Local Security Checks	2015/5/18	2018/4/18	medium
218346	Linux Distros Unpatched Vulnerability : CVE-2014-0099	Nessus	Misc.	2025/3/4	2026/8/4	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high