CVE-2012-3544

描述

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

如何修補 CVE-2012-3544

要修補 CVE-2012-3544,請將受影響套件升級到下列已修補版本。

• Debian/tomcat6—升級至 6.0.35-1+squeeze3 或更新版本
• Debian/tomcat7—升級至 7.0.28-4+deb7u1 或更新版本
• Maven/org.apache.tomcat:tomcat—升級至 6.0.37 或更新版本

CVE-2012-3544 正在被利用嗎?

中等 — EPSS 為 11.0%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 6.0.35-1+squeeze3
• from 0, < 7.0.28-4+deb7u1
• >= 6.0.0, < 6.0.37

參考連結(25)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-3544
• PATCHgithub.com/apache/tomcat
• WEBseclists.org/fulldisclosure/2014/Dec/23
• WEBsvn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592&r2=1476591&pathrev=1476592