KLA10072 Multiple vulnerabilities in Apache Tomcat

Multiple serious vulnerabilities have been found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions and read arbitrary files. Below is a complete list of vulnerabilities

1. An integer overflow vulnerability can be exploited remotely via a specially designed request streaming or a specially designed HTTP header;
2. An improper XSLT restriction vulnerability can be exploited remotely via a specially designed web application;

Original advisories

Apache bulletin

Related products

Apache-Tomcat

CVE list

CVE-2014-0075 critical

CVE-2014-0096 warning

CVE-2014-0099 warning

Solution

Update to latest version

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Apache Tomcat 7 versions 7.0.52 and earlier