National Cyber Awareness System

Vulnerability Summary for CVE-2010-2227

Overview

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=959428

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=959428

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=958977

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=958977

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=958911

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=958911

External Source: XF

Name: tomcat-transferencoding-dos(60264)

Hyperlink:http://xforce.iss.net/xforce/xfdb/60264

External Source: VUPEN

Name: ADV-2010-3056

Hyperlink:http://www.vupen.com/english/advisories/2010/3056

External Source: VUPEN

Name: ADV-2010-2868

Hyperlink:http://www.vupen.com/english/advisories/2010/2868

External Source: VUPEN

Name: ADV-2010-1986

Hyperlink:http://www.vupen.com/english/advisories/2010/1986

External Source: CONFIRM

Name: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Hyperlink:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BID

Name: 41544

Hyperlink:http://www.securityfocus.com/bid/41544

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: BUGTRAQ

Name: 20100709 [SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/512272/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0583

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0583.html

External Source: REDHAT

Name: RHSA-2010:0582

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0582.html

External Source: REDHAT

Name: RHSA-2010:0581

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0581.html

External Source: REDHAT

Name: RHSA-2010:0580

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0580.html

External Source: CONFIRM

Name: http://www.novell.com/support/viewContent.do?externalId=7007275

Hyperlink:http://www.novell.com/support/viewContent.do?externalId=7007275

External Source: CONFIRM

Name: http://www.novell.com/support/viewContent.do?externalId=7007274

Hyperlink:http://www.novell.com/support/viewContent.do?externalId=7007274

External Source: MANDRIVA

Name: MDVSA-2010:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: DEBIAN

Name: DSA-2207

Hyperlink:http://www.debian.org/security/2011/dsa-2207

External Source: CONFIRM

Name: http://tomcat.apache.org/security-7.html

Type: Advisory

Hyperlink:http://tomcat.apache.org/security-7.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Type: Advisory

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Type: Advisory

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://support.apple.com/kb/HT5002

Hyperlink:http://support.apple.com/kb/HT5002

External Source: SECTRACK

Name: 1024180

Hyperlink:http://securitytracker.com/id?1024180

External Source: SECUNIA

Name: 44183

Hyperlink:http://secunia.com/advisories/44183

External Source: SECUNIA

Name: 43310

Hyperlink:http://secunia.com/advisories/43310

External Source: SECUNIA

Name: 42454

Hyperlink:http://secunia.com/advisories/42454

External Source: SECUNIA

Name: 42368

Hyperlink:http://secunia.com/advisories/42368

External Source: SECUNIA

Name: 42079

Hyperlink:http://secunia.com/advisories/42079

External Source: SECUNIA

Name: 41025

Hyperlink:http://secunia.com/advisories/41025

External Source: SECUNIA

Name: 40813

Hyperlink:http://secunia.com/advisories/40813

External Source: HP

Name: SSRT101146

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: HPSBUX02860

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: HPSBUX02579

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: HP

Name: HPSBUX02579

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: SUSE

Name: SUSE-SR:2010:017

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

External Source: FEDORA

Name: FEDORA-2010-16270

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html

External Source: FEDORA

Name: FEDORA-2010-16248

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html

External Source: APPLE

Name: APPLE-SA-2011-10-12-3

Hyperlink:http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

External Source: CONFIRM

Name: http://geronimo.apache.org/22x-security-report.html

Hyperlink:http://geronimo.apache.org/22x-security-report.html

External Source: CONFIRM

Name: http://geronimo.apache.org/21x-security-report.html

Hyperlink:http://geronimo.apache.org/21x-security-report.html