CVE-2007-6286

Apache Tomcat 5.5.11-5.5.25 and 6.0.0-6.0.15 - Request Handling Flaw via Empty SSL Request

Title source: llm

Description

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

References (30)

Core 30

Core References

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/3637

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30676

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28915

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37460

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/31681

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28878

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/487823/100/0/threaded

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/0488

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Various Sources x_refsource_confirm

http://tomcat.apache.org/security-6.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/57126

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32222

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200804-10.xml

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1856/references

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2008-0010.html

Various Sources x_refsource_confirm

http://tomcat.apache.org/security-5.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/2780

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT3216

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29711

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/3316

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.0537

EPSS Percentile 91.8%

Details

Status published

Products (32)

apache/tomcat 5.5.11

apache/tomcat 5.5.12

apache/tomcat 5.5.13

apache/tomcat 5.5.14

apache/tomcat 5.5.15

apache/tomcat 5.5.16

apache/tomcat 5.5.17

apache/tomcat 5.5.18

apache/tomcat 5.5.19

apache/tomcat 5.5.20

... and 22 more

Published Feb 12, 2008

Tracked Since Feb 18, 2026