Bug 354081

Summary:	<www-servers/tomcat-{6.0.32,7.0.8}: Remote DOS (CVE-2011-0534)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	java, mike
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://svn.apache.org/viewvc?view=revision&revision=1066313
Whiteboard:	B3 [ebuild]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2011-02-08 14:06:58 UTC

Important: Remote Denial Of Service CVE-2011-0534

The NIO connector expands its buffer endlessly during request line processing. That behaviour can be used for a denial of service attack using a carefully crafted request.

This was fixed in revision 1065939.

This was identified by the Tomcat security team on 27 Jan 2011 and made public on 5 Feb 2011.

Note: The issue below was fixed in Apache Tomcat 6.0.31 but the release vote for the 6.0.31 release candidate did not pass. Therefore, although users must download 6.0.32 to obtain a version that includes a fix for this issue, version 6.0.31 is not included in the list of affected versions.

Note: The issue below was fixed in Apache Tomcat 7.0.7 but the release vote for the 7.0.7 release candidate did not pass. Therefore, although users must download 7.0.8 to obtain a version that includes a fix for this issue, version 7.0.7 is not included in the list of affected versions.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2011-02-09 00:31:02 UTC


*** This bug has been marked as a duplicate of bug 329937 ***