CVE-2010-2227 – tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

https://notcve.org/view.php?id=CVE-2010-2227

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." Apache Tomcat v5.5.0 hasta v5.5.29, v6.0.0 hasta v6.0.27 y v7.0.0 beta, no maneja apropiadamente una cabecera Transer-Encoding inválida, lo que permite a atacantes remotos causar una denegación de servicio (indisponibilidad de la aplicación) u obtener información sensible a través de una cabecera manipulada que interfiera con el "reciclado del búffer" ("recycling of a buffer"). • http://geronimo.apache.org/21x-security-report.html http://geronimo.apache.org/22x-security-report.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://marc.info/?l=bugtraq&m=129070310906557&w=2 http://marc.info/?l=bugt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •