CVE-2011-2526: Input Validation
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
Other sources
The Tomcat sendfile support (when HTTP APR or HTTP NIO connectors are enabled) allows to send large static files. These writes, as soon as the system load increases, will be performed asynchronously in the most efficient way.
It was found that Tomcat, the Apache Servlet/JSP Engine, did not properly sanitize arguments provided to sendfile call methods, when a web application was running under the security manager: 1) such application could use the sendfile support to expose server files, that should be made inaccessible by the security manager, 2) when HTTP APR/native connector was used, such application could specify invalid sendfile start/end points and trigger a JVM crash.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2526?
CVE-2011-2526 has a medium severity rating due to its potential for local file access bypass and denial of service.
How do I fix CVE-2011-2526?
To resolve CVE-2011-2526, upgrade your Apache Tomcat to version 7.0.19 or later, 6.0.33 or later, or 5.5.34 or later.
What versions of Apache Tomcat are affected by CVE-2011-2526?
CVE-2011-2526 affects Apache Tomcat versions before 5.5.34, 6.0.33, and 7.0.19.
Can CVE-2011-2526 be exploited remotely?
CVE-2011-2526 is primarily a local vulnerability, allowing local users to exploit it.
What are the potential impacts of CVE-2011-2526?
Exploitation of CVE-2011-2526 can lead to unauthorized file access or cause a denial of service through an infinite loop.