CVE-2007-6286: Infoleak
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6286?
CVE-2007-6286 has been rated as a critical severity vulnerability as it allows remote attackers to exploit the system.
How do I fix CVE-2007-6286?
To fix CVE-2007-6286, upgrade Apache Tomcat to version 5.5.26 or later for 5.5.x series, and to 6.0.16 or later for 6.0.x series.
What versions of Apache Tomcat are affected by CVE-2007-6286?
CVE-2007-6286 affects Apache Tomcat versions 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15.
Can CVE-2007-6286 be exploited remotely?
Yes, CVE-2007-6286 can be exploited remotely by sending specially crafted empty requests to the SSL port.
What component of Apache Tomcat does CVE-2007-6286 impact?
CVE-2007-6286 impacts the native APR connector of Apache Tomcat.