CVE-2012-3544: Input Validation

Q: What is the severity of CVE-2012-3544?

CVE-2012-3544 has been assigned a severity rating of medium due to its potential to cause denial of service.

Q: How do I fix CVE-2012-3544?

To fix CVE-2012-3544, update Apache Tomcat to the latest version or apply the specific patches available for affected releases.

Q: Which versions of Apache Tomcat are affected by CVE-2012-3544?

CVE-2012-3544 affects Apache Tomcat versions up to 7.0.23 and 6.0.36.

Q: Can CVE-2012-3544 be exploited remotely?

Yes, CVE-2012-3544 can be exploited remotely by attackers who can send specially crafted HTTP requests.

Q: What are the consequences of an attack exploiting CVE-2012-3544?

Exploiting CVE-2012-3544 can lead to a denial of service situation, causing the affected server to become unresponsive.

Published May 10, 2013

Updated

A denial of service flaw was found in the way chunked transfer encoding input filter of Apache Tomcat, an Apache Servlet/JSP Engine, processed CRLF sequences at the end of data chunks in certain circumstances. When the chunked transfer encoding was enabled, a remote attacker could issue a specially-crafted request that, when processed would lead to (limited) denial of service of the Apache Tomcat server.

Relevant upstream patch: for Apache Tomcat 6.x: http://svn.apache.org/viewvc?view=revision&revision=1476592

for Apache Tomcat 7:x: http://svn.apache.org/viewvc?view=rev&rev=1378702 http://svn.apache.org/viewvc?view=rev&rev=1378921

Other sources

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

Affected Software

94 affected componentsFixes available

redhat/Apache Tomcat<6.0.37

6.0.37

redhat/Apache Tomcat<7.0.30

7.0.30

redhat/apache-commons-daemon-eap6<1:1.0.15-4.redhat_1.ep6.el5

1:1.0.15-4.redhat_1.ep6.el5

redhat/apache-commons-daemon-jsvc-eap6<1:1.0.15-1.redhat_1.ep6.el5

1:1.0.15-1.redhat_1.ep6.el5

redhat/apache-commons-pool-eap6<0:1.6-6.redhat_4.ep6.el5

0:1.6-6.redhat_4.ep6.el5

redhat/dom4j<0:1.6.1-19.redhat_5.ep6.el5

0:1.6.1-19.redhat_5.ep6.el5

redhat/ecj3<1:3.7.2-6.redhat_1.ep6.el5

1:3.7.2-6.redhat_1.ep6.el5

redhat/httpd<0:2.2.22-23.ep6.el5

0:2.2.22-23.ep6.el5

redhat/tomcat6<0:6.0.37-8_patch_01.ep6.el5

0:6.0.37-8_patch_01.ep6.el5

redhat/tomcat7<0:7.0.40-9_patch_01.ep6.el5

0:7.0.40-9_patch_01.ep6.el5

redhat/tomcat-native<0:1.1.27-4.redhat_1.ep6.el5

0:1.1.27-4.redhat_1.ep6.el5

redhat/apache-commons-daemon-eap6<1:1.0.15-4.redhat_1.ep6.el6

1:1.0.15-4.redhat_1.ep6.el6

redhat/apache-commons-daemon-jsvc-eap6<1:1.0.15-1.redhat_1.ep6.el6

1:1.0.15-1.redhat_1.ep6.el6

redhat/apache-commons-pool-eap6<0:1.6-6.redhat_4.ep6.el6

0:1.6-6.redhat_4.ep6.el6

redhat/dom4j<0:1.6.1-19.redhat_5.ep6.el6

0:1.6.1-19.redhat_5.ep6.el6

redhat/ecj3<1:3.7.2-6.redhat_1.ep6.el6

1:3.7.2-6.redhat_1.ep6.el6

redhat/httpd<0:2.2.22-23.ep6.el6

0:2.2.22-23.ep6.el6

redhat/tomcat6<0:6.0.37-10_patch_01.ep6.el6

0:6.0.37-10_patch_01.ep6.el6

redhat/tomcat7<0:7.0.40-5_patch_01.ep6.el6

0:7.0.40-5_patch_01.ep6.el6

redhat/tomcat-native<0:1.1.27-4.redhat_1.ep6.el6

0:1.1.27-4.redhat_1.ep6.el6

Tomcat=6.0

Tomcat=6.0.0

Tomcat=6.0.0-alpha

Tomcat=6.0.1

Tomcat=6.0.1-alpha

Tomcat=6.0.2

Tomcat=6.0.2-alpha

Tomcat=6.0.2-beta

Tomcat=6.0.3

Tomcat=6.0.4

Tomcat=6.0.4-alpha

Tomcat=6.0.5

Tomcat=6.0.6

Tomcat=6.0.6-alpha

Tomcat=6.0.7

Tomcat=6.0.7-alpha

Tomcat=6.0.7-beta

Tomcat=6.0.8

Tomcat=6.0.8-alpha

Tomcat=6.0.9

Tomcat=6.0.9-beta

Tomcat=6.0.10

Tomcat=6.0.11

Tomcat=6.0.12

Tomcat=6.0.13

Tomcat=6.0.14

Tomcat=6.0.15

Tomcat=6.0.16

Tomcat=6.0.17

Tomcat=6.0.18

Tomcat=6.0.19

Tomcat=6.0.20

Tomcat=6.0.24

Tomcat=6.0.26

Tomcat=6.0.27

Tomcat=6.0.28

Tomcat=6.0.29

Tomcat=6.0.30

Tomcat=6.0.31

Tomcat=6.0.32

Tomcat=6.0.33

Tomcat=6.0.35

Tomcat=6.0.36

Tomcat=7.0.0

Tomcat=7.0.0-beta

Tomcat=7.0.1

Tomcat=7.0.2

Tomcat=7.0.2-beta

Tomcat=7.0.3

Tomcat=7.0.4

Tomcat=7.0.4-beta

Tomcat=7.0.5

Tomcat=7.0.6

Tomcat=7.0.7

Tomcat=7.0.8

Tomcat=7.0.9

Tomcat=7.0.10

Tomcat=7.0.11

Tomcat=7.0.12

Tomcat=7.0.13

Tomcat=7.0.14

Tomcat=7.0.15

Tomcat=7.0.16

Tomcat=7.0.17

Tomcat=7.0.18

Tomcat=7.0.19

Tomcat=7.0.20

Tomcat=7.0.21

Tomcat=7.0.22

Tomcat=7.0.23

Tomcat=7.0.25

Tomcat=7.0.28

maven/org.apache.tomcat:tomcat>=7.0.0<7.0.30

7.0.30

maven/org.apache.tomcat:tomcat>=6.0.0<6.0.37

6.0.37

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/Apache Tomcat to a version that resolves this vulnerability.
Fixed in 6.0.37
Upgrade
Upgrade redhat/Apache Tomcat to a version that resolves this vulnerability.
Fixed in 7.0.30
Upgrade
Upgrade redhat/apache-commons-daemon-eap6 to a version that resolves this vulnerability.
Fixed in 1:1.0.15-4.redhat_1.ep6.el5
Upgrade
Upgrade redhat/apache-commons-daemon-jsvc-eap6 to a version that resolves this vulnerability.
Fixed in 1:1.0.15-1.redhat_1.ep6.el5
Upgrade
Upgrade redhat/apache-commons-pool-eap6 to a version that resolves this vulnerability.
Fixed in 0:1.6-6.redhat_4.ep6.el5
Upgrade
Upgrade redhat/dom4j to a version that resolves this vulnerability.
Fixed in 0:1.6.1-19.redhat_5.ep6.el5
Upgrade
Upgrade redhat/ecj3 to a version that resolves this vulnerability.
Fixed in 1:3.7.2-6.redhat_1.ep6.el5
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 0:2.2.22-23.ep6.el5
Upgrade
Upgrade redhat/tomcat6 to a version that resolves this vulnerability.
Fixed in 0:6.0.37-8_patch_01.ep6.el5
Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.40-9_patch_01.ep6.el5
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.1.27-4.redhat_1.ep6.el5
Upgrade
Upgrade redhat/apache-commons-daemon-eap6 to a version that resolves this vulnerability.
Fixed in 1:1.0.15-4.redhat_1.ep6.el6
Upgrade
Upgrade redhat/apache-commons-daemon-jsvc-eap6 to a version that resolves this vulnerability.
Fixed in 1:1.0.15-1.redhat_1.ep6.el6
Upgrade
Upgrade redhat/apache-commons-pool-eap6 to a version that resolves this vulnerability.
Fixed in 0:1.6-6.redhat_4.ep6.el6
Upgrade
Upgrade redhat/dom4j to a version that resolves this vulnerability.
Fixed in 0:1.6.1-19.redhat_5.ep6.el6
Upgrade
Upgrade redhat/ecj3 to a version that resolves this vulnerability.
Fixed in 1:3.7.2-6.redhat_1.ep6.el6
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 0:2.2.22-23.ep6.el6
Upgrade
Upgrade redhat/tomcat6 to a version that resolves this vulnerability.
Fixed in 0:6.0.37-10_patch_01.ep6.el6
Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.40-5_patch_01.ep6.el6
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.1.27-4.redhat_1.ep6.el6
Upgrade
Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.
Fixed in 7.0.30
Upgrade
Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.
Fixed in 6.0.37
Upgrade
Upgrade Apache Tomcat 6.x to a version that resolves this vulnerability.
Fixed in 6.0.37
Upgrade
Upgrade Apache Tomcat 7.x to a version that resolves this vulnerability.
Fixed in 7.0.30

Event History

May 10, 2013

CVE Published

12:00 AM

Jun 1, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·02:21 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 14, 2022

Advisory Published

via GitHub·01:10 AM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2012-3544?