CVE-2014-0230 – tomcat: non-persistent DoS attack by feeding data by aborting an upload

https://notcve.org/view.php?id=CVE-2014-0230

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. Apache Tomcat 6.x en versiones anteriores a 6.0.44, 7.x en versiones anteriores a 7.0.55 y 8.x en versiones anteriores a 8.0.9 no maneja adecuadamente los casos en los que se produce una respuesta HTTP antes de terminar la lectura de una petición de cuerpo entero, lo que permite a atacantes remotos causar una denegación de servicio (consumo de hilo) a través de una serie de intentos de carga abortada. It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made. • http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E http://marc.info/?l=bugtraq&m=144498216801440&w=2 http://marc.info/?l=bugtraq&m=145974991225029&w=2 http://openwall.com/lists/oss-security/2015/04/10/1 http://rhn.redhat.com/errata/RHSA-2015-1621.html http://rhn.redhat.com/errata/RHSA-2015-1622.html http://rhn.redhat.com/errata/RHSA-2015-2661.html http://rhn.redhat.com/errata/RHSA-2016-0595.html http:/ • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •