National Cyber Awareness System

Vulnerability Summary for CVE-2011-1475

Overview

The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=1086352

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=1086352

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=1086349

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=1086349

External Source: MISC

Name: https://issues.apache.org/bugzilla/show_bug.cgi?id=50957

Hyperlink:https://issues.apache.org/bugzilla/show_bug.cgi?id=50957

External Source: XF

Name: tomcat-httpbio-info-disclosure(66676)

Hyperlink:http://xforce.iss.net/xforce/xfdb/66676

External Source: VUPEN

Name: ADV-2011-0894

Hyperlink:http://www.vupen.com/english/advisories/2011/0894

External Source: SECTRACK

Name: 1025303

Hyperlink:http://www.securitytracker.com/id?1025303

External Source: BID

Name: 47199

Hyperlink:http://www.securityfocus.com/bid/47199

External Source: BUGTRAQ

Name: 20110406 [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

Hyperlink:http://www.securityfocus.com/archive/1/517363

External Source: CONFIRM

Name: http://tomcat.apache.org/security-7.html

Type: Advisory

Hyperlink:http://tomcat.apache.org/security-7.html

External Source: SREASON

Name: 8188

Hyperlink:http://securityreason.com/securityalert/8188

External Source: FULLDISC

Name: 20110406 [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

Hyperlink:http://seclists.org/fulldisclosure/2011/Apr/97

External Source: OVAL

Name: oval:org.mitre.oval:def:12374

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12374

References to Check Content

Identifier:oval:org.mitre.oval:def:12374

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12374