FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-4534

This CVE name corresponds to:

Entered	Topic
2012-12-04	tomcat -- denial of service

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-4534 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-4534
Phase	Assigned(20120821)

Description

org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.

References

Source	Reference
BUGTRAQ	20121204 CVE-2012-4534 Apache Tomcat denial of service
CONFIRM	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/NioEndpoint.java?r1=1340218&r2=1340217&pathrev=1340218
CONFIRM	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1340218&r2=1340217&pathrev=1340218
CONFIRM	http://svn.apache.org/viewvc?view=revision&revision=1340218
CONFIRM	http://tomcat.apache.org/security-6.html
CONFIRM	http://tomcat.apache.org/security-7.html
CONFIRM	https://issues.apache.org/bugzilla/show_bug.cgi?id=52858
HP	HPSBMU02873
HP	SSRT101182
HP	HPSBST02955
REDHAT	RHSA-2013:0623
SUSE	openSUSE-SU-2013:0161
SUSE	openSUSE-SU-2013:0170
SUSE	openSUSE-SU-2013:0192
UBUNTU	USN-1685-1
OVAL	oval:org.mitre.oval:def:19398
SECTRACK	1027836
SECUNIA	57126